CVE-2025-57296
📋 TL;DR
This CVE describes a command injection vulnerability in Tenda AC6 router firmware that allows attackers to execute arbitrary system commands. The vulnerability affects users of Tenda AC6 routers with vulnerable firmware versions, potentially compromising router security and network integrity.
💻 Affected Systems
- Tenda AC6 router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attacker to install persistent backdoors, intercept network traffic, pivot to internal networks, or brick the device.
Likely Case
Router compromise leading to network traffic interception, DNS hijacking, credential theft, or use as botnet node.
If Mitigated
Limited impact if router is behind firewall with restricted WAN access and strong network segmentation.
🎯 Exploit Status
Requires crafting specific POST requests to the vulnerable endpoint with command injection payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Tenda website for latest firmware
Vendor Advisory: https://tenda.com.cn/material/show/2681
Restart Required: No
Instructions:
1. Log into router admin interface. 2. Navigate to System Tools > Firmware Upgrade. 3. Download latest firmware from Tenda website. 4. Upload and install firmware update. 5. Verify successful update.
🔧 Temporary Workarounds
Disable remote administration
allPrevents external exploitation by disabling remote access to router web interface
Restrict web interface access
allLimit access to router admin interface to trusted IP addresses only
🧯 If You Can't Patch
- Replace router with different model or vendor
- Place router behind dedicated firewall with strict inbound rules
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or System ToolsCheck Version:
Login to router web interface and navigate to System Status pageVerify Fix Applied:
Verify firmware version is newer than 15.03.05.19 after update📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/SetIPTVCfg
- System command execution in router logs
- Multiple failed authentication attempts
Network Indicators:
- Unusual outbound connections from router
- DNS queries to suspicious domains
- Unexpected port scans originating from router
SIEM Query:
source="router_logs" AND (uri="/goform/SetIPTVCfg" OR command="doSystemCmd")