CVE-2025-55503
📋 TL;DR
This CVE describes a stack overflow vulnerability in Tenda AC6 routers that allows attackers to execute arbitrary code by sending specially crafted requests to the deviceName parameter in the saveParentControlInfo function. The vulnerability affects Tenda AC6 routers running firmware version V15.03.06.23_multi. Attackers can potentially gain full control of affected routers.
💻 Affected Systems
- Tenda AC6
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete router compromise, credential theft, network traffic interception, and lateral movement into connected devices.
Likely Case
Router compromise allowing attackers to change DNS settings, intercept traffic, or use the router as a foothold for further attacks.
If Mitigated
Limited impact if network segmentation prevents lateral movement and router is isolated from critical systems.
🎯 Exploit Status
Proof of concept is publicly available on GitHub, making exploitation straightforward for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. If update available, download and install via router admin interface. 3. Reboot router after installation.
🔧 Temporary Workarounds
Disable Parent Control Feature
allDisable the parent control functionality that contains the vulnerable saveParentControlInfo function.
Network Segmentation
allIsolate the router from critical internal networks to limit potential damage.
🧯 If You Can't Patch
- Replace affected routers with different models or brands
- Implement strict firewall rules to limit access to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is V15.03.06.23_multi on Tenda AC6 V2.0, device is vulnerable.Check Version:
Check router web interface at 192.168.0.1 or 192.168.1.1, navigate to System Status or About page.Verify Fix Applied:
Verify firmware version has been updated to a version newer than V15.03.06.23_multi.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to saveParentControlInfo endpoint
- Multiple failed login attempts followed by successful access
- Unexpected configuration changes
Network Indicators:
- Unusual outbound connections from router
- DNS changes to malicious servers
- Traffic redirection patterns
SIEM Query:
source="router_logs" AND (uri="/goform/saveParentControlInfo" OR message="deviceName" AND length>100)