CVE-2025-45779
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Tenda AC10 routers via a buffer overflow in the formSetPPTPUserList handler. Attackers can exploit this by sending specially crafted POST requests to the vulnerable endpoint. All users running the affected firmware version on Tenda AC10 V1.0 routers are at risk.
💻 Affected Systems
- Tenda AC10 V1.0
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router leading to persistent backdoor installation, credential theft, network traffic interception, and lateral movement to connected devices.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or use the router as a pivot point for further attacks.
If Mitigated
Limited impact if the router is behind a firewall with restricted WAN access and proper network segmentation is implemented.
🎯 Exploit Status
The GitHub repository contains proof-of-concept code demonstrating exploitation. The high CVSS score and public PoC make weaponization likely.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tendacn.com/us/download/detail-3782.html
Restart Required: Yes
Instructions:
1. Check Tenda's official website for firmware updates. 2. Download the latest firmware for AC10 V1.0. 3. Log into router admin interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install the new firmware. 6. Wait for router to reboot.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to the router's web management interface
Log into router admin > Advanced > System Tools > Remote Management > Disable
Restrict Management Interface Access
linuxUse firewall rules to limit access to router management port (typically 80/443)
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Isolate the router in a separate VLAN with strict firewall rules
- Implement network monitoring for suspicious POST requests to /goform/setPPTPUserList
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or System Tools > Firmware UpgradeCheck Version:
curl -s http://router_ip/login/Auth | grep -i firmware || Check web interface manuallyVerify Fix Applied:
Verify firmware version is newer than V15.03.06.46 and test that the /goform/setPPTPUserList endpoint properly validates input📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/setPPTPUserList
- Large payloads in POST parameters
- Router reboot events after suspicious requests
Network Indicators:
- HTTP POST requests to router IP on port 80/443 with 'list' parameter containing long strings
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (uri_path="/goform/setPPTPUserList" OR http_method="POST" AND uri_path CONTAINS "PPTP")