CVE-2025-5794
📋 TL;DR
A critical buffer overflow vulnerability in Tenda AC5 routers allows remote attackers to execute arbitrary code by manipulating the PPTP user list function. This affects Tenda AC5 routers running firmware version 15.03.06.47. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda AC5
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, lateral movement into internal networks, persistent backdoor installation, and data exfiltration.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept network traffic, or use the device as a pivot point for further attacks.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access, though internal threats could still exploit if network access is gained.
🎯 Exploit Status
Exploit details are publicly available, making weaponization likely. The vulnerability requires sending crafted HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware for AC5 model. 3. Access router admin interface. 4. Navigate to firmware upgrade section. 5. Upload and apply new firmware. 6. Reboot router after update.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router management interface
Network Segmentation
allIsolate router management interface to trusted network segments only
🧯 If You Can't Patch
- Replace affected devices with patched or alternative models
- Implement strict network access controls to limit exposure to vulnerable interfaces
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface. If version is 15.03.06.47, device is vulnerable.Check Version:
Login to router admin interface and check System Status or Firmware Version pageVerify Fix Applied:
Verify firmware version has been updated to a version later than 15.03.06.47📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to /goform/setPptpUserList
- Multiple failed authentication attempts followed by successful access to vulnerable endpoint
- Unexpected system reboots or configuration changes
Network Indicators:
- HTTP traffic to router management interface with unusual payload sizes
- Traffic patterns suggesting buffer overflow attempts
- Unexpected outbound connections from router
SIEM Query:
source="router_logs" AND (uri="/goform/setPptpUserList" OR method="POST" AND uri CONTAINS "setPptpUserList")🔗 References
- https://lavender-bicycle-a5a.notion.site/Tenda-AC5-formSetPPTPUserList-20a53a41781f806faf61cef61ed929c0?source=copy_link
- https://vuldb.com/?ctiid.311348
- https://vuldb.com/?id.311348
- https://vuldb.com/?submit.591223
- https://www.tenda.com.cn/
- https://lavender-bicycle-a5a.notion.site/Tenda-AC5-formSetPPTPUserList-20a53a41781f806faf61cef61ed929c0
