CVE-2025-5608
📋 TL;DR
A critical buffer overflow vulnerability in Tenda AC18 routers allows remote attackers to execute arbitrary code by manipulating the rebootTime parameter. This affects Tenda AC18 routers running firmware version 15.03.05.05. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda AC18
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, lateral movement to internal networks, persistent backdoor installation, and data exfiltration.
Likely Case
Router compromise allowing network traffic interception, DNS hijacking, credential theft, and botnet recruitment.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access, though internal threats remain possible.
🎯 Exploit Status
Public exploit details are available, making this easily weaponizable. No authentication required for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. If update available, download and install via router web interface. 3. Reboot router after update. 4. Verify firmware version changed from 15.03.05.05.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Access router admin panel → Advanced Settings → Remote Management → Disable
Network Segmentation
allIsolate router management interface from untrusted networks
Configure firewall rules to block external access to port 80/443 on router IP
🧯 If You Can't Patch
- Replace affected router with different model/brand
- Place router behind dedicated firewall with strict inbound rules
🔍 How to Verify
Check if Vulnerable:
Access router web interface → System Status → Firmware Version. Check if version is 15.03.05.05.Check Version:
curl -s http://router-ip/login/Auth | grep firmware_versionVerify Fix Applied:
After update, verify firmware version is no longer 15.03.05.05. Test if /goform/SetSysAutoRebbotCfg endpoint still accepts malformed rebootTime parameter.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/SetSysAutoRebbotCfg
- Multiple failed reboot attempts
- Abnormal process creation on router
Network Indicators:
- Exploit traffic patterns to router port 80/443
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (url="/goform/SetSysAutoRebbotCfg" OR process="malicious_payload")