CVE-2025-45042
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on Tenda AC9 routers via the Telnet service. Attackers can gain full control of affected devices, potentially compromising network security. Users running Tenda AC9 v15.03.05.14 are affected.
💻 Affected Systems
- Tenda AC9
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to network compromise, data exfiltration, lateral movement to other devices, and persistent backdoor installation.
Likely Case
Router compromise allowing traffic interception, DNS hijacking, credential theft, and use as botnet node.
If Mitigated
Limited impact if Telnet is disabled and device is isolated from untrusted networks.
🎯 Exploit Status
Public exploit details available in GitHub repository. Command injection via Telnet requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
Check Tenda official website for firmware updates. If update available, download and flash via web interface.
🔧 Temporary Workarounds
Disable Telnet Service
linuxTurn off Telnet service to prevent exploitation of this vulnerability
telnetd stop
killall telnetd
Block Telnet Port
linuxBlock incoming Telnet connections at firewall
iptables -A INPUT -p tcp --dport 23 -j DROP
🧯 If You Can't Patch
- Isolate affected routers from internet and untrusted networks
- Implement network segmentation to limit lateral movement
🔍 How to Verify
Check if Vulnerable:
Check if Telnet service is running on port 23 and firmware version is v15.03.05.14Check Version:
cat /proc/version | grep -i tendaVerify Fix Applied:
Verify Telnet service is disabled and no longer responding on port 23📡 Detection & Monitoring
Log Indicators:
- Unusual Telnet connection attempts
- Suspicious command execution in system logs
- Multiple failed Telnet authentication attempts
Network Indicators:
- Telnet traffic to router from unexpected sources
- Outbound connections from router to suspicious IPs
SIEM Query:
source="router_logs" AND ("telnet" OR "port 23") AND ("command" OR "exec" OR "injection")