CVE-2025-5847
📋 TL;DR
This critical vulnerability in Tenda AC9 routers allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the web management interface. Attackers can exploit this by sending specially crafted HTTP POST requests to the vulnerable endpoint. All users running affected firmware versions are at risk.
💻 Affected Systems
- Tenda AC9
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, lateral movement to connected devices, and botnet recruitment.
Likely Case
Remote code execution allowing attacker to modify router settings, intercept traffic, deploy malware, or use the device as a pivot point for further attacks.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access, though internal network attacks remain possible.
🎯 Exploit Status
Public exploit details are available, and the vulnerability requires no authentication, making it trivial to weaponize.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware for AC9 model. 3. Access router web interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install new firmware. 6. Reboot router after installation.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to the vulnerable web interface by disabling remote management features.
Network Segmentation
allIsolate the router on a separate VLAN with restricted access to prevent lateral movement if compromised.
🧯 If You Can't Patch
- Replace affected devices with patched or alternative models
- Implement strict network access controls to limit traffic to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at System Status > Firmware Version. If version is 15.03.02.13, device is vulnerable.Check Version:
curl -s http://router-ip/ | grep -i firmware or check web interface directlyVerify Fix Applied:
After firmware update, verify version is no longer 15.03.02.13. Test by attempting to access /goform/SetRemoteWebCfg with monitoring for crash or unexpected behavior.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/SetRemoteWebCfg with abnormal remoteIp parameter length
- Router crash/reboot logs
- Unusual process execution on router
Network Indicators:
- HTTP traffic to router port 80 with POST to vulnerable endpoint
- Unusual outbound connections from router after exploitation
SIEM Query:
source="router-logs" AND (uri_path="/goform/SetRemoteWebCfg" AND method="POST" AND content_length>100)