CVE-2025-52054
📋 TL;DR
This vulnerability allows unauthenticated attackers to calculate the root password of Tenda AC8 routers using a static algorithm based on the device's MAC address. Attackers can then authenticate to network services on the device. All users of affected Tenda AC8 routers with vulnerable firmware are impacted.
💻 Affected Systems
- Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise allowing attacker to reconfigure network settings, intercept traffic, install malware, or use the device as a pivot point into the internal network.
Likely Case
Unauthorized access to router administration interface leading to network configuration changes, DNS hijacking, or credential theft from connected devices.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and strong network segmentation.
🎯 Exploit Status
Exploit requires only the device's MAC address (often visible in network scans) and simple calculation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates
2. Download latest firmware for AC8 v4.0
3. Access router admin interface
4. Navigate to System Tools > Firmware Upgrade
5. Upload and install new firmware
6. Reboot router
🔧 Temporary Workarounds
Change root password
allManually change the root password to a strong, unique password
Disable remote administration
allTurn off WAN access to router administration interface
🧯 If You Can't Patch
- Replace affected routers with different models or brands
- Isolate vulnerable routers in separate network segments with strict firewall rules
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or System Tools. If version is 16.03.33.05, device is vulnerable.Check Version:
Not applicable - check via router web interfaceVerify Fix Applied:
After firmware update, verify version is no longer 16.03.33.05. Test authentication with old calculated password should fail.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful root login
- Multiple login attempts from unusual IP addresses
- Configuration changes from unknown sources
Network Indicators:
- Unexpected connections to router administration ports (typically 80, 443, 8080)
- DNS configuration changes
- Unusual outbound traffic from router
SIEM Query:
source="router_logs" ("authentication success" OR "login success") AND user="root"