CVE-2025-5862
📋 TL;DR
A critical buffer overflow vulnerability in Tenda AC7 routers allows remote attackers to execute arbitrary code by manipulating the PPTP user list function. This affects Tenda AC7 routers running firmware version 15.03.06.44. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda AC7
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, enabling attackers to install malware, pivot to internal networks, or create persistent backdoors.
Likely Case
Remote code execution resulting in device takeover, allowing attackers to intercept network traffic, modify router settings, or launch attacks against internal systems.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering, though internal attacks remain possible if the exploit reaches the device.
🎯 Exploit Status
Public exploit details are available, making weaponization likely. The vulnerability requires no authentication and has low exploitation complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: No
Instructions:
Check Tenda's official website for firmware updates. If available, download the latest firmware and apply it through the router's web interface under System Tools > Firmware Upgrade.
🔧 Temporary Workarounds
Disable PPTP VPN
allDisable the PPTP VPN feature if not required, as the vulnerability is in the PPTP user list function.
Restrict Management Interface Access
allConfigure firewall rules to restrict access to the router's web management interface (typically port 80/443) to trusted IP addresses only.
🧯 If You Can't Patch
- Isolate affected routers in a separate network segment with strict access controls.
- Implement network monitoring and intrusion detection for suspicious traffic to the router's management interface.
🔍 How to Verify
Check if Vulnerable:
Check the router's firmware version via the web interface (typically under System Status or System Tools). If the version is 15.03.06.44, the device is vulnerable.Check Version:
No CLI command available; check via web interface at http://[router-ip]/Verify Fix Applied:
After updating firmware, verify the version has changed from 15.03.06.44 to a newer version.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/setPptpUserList with large payloads
- Failed authentication attempts or unexpected configuration changes
Network Indicators:
- Suspicious HTTP traffic to router's IP on port 80/443 with POST requests to vulnerable endpoint
- Unexpected outbound connections from the router
SIEM Query:
http.method:POST AND http.uri:"/goform/setPptpUserList" AND (bytes_out:>1000 OR user_agent:unusual)🔗 References
- https://lavender-bicycle-a5a.notion.site/Tenda-AC7-formSetPPTPUserList-20a53a41781f806ca124cbdf99bff931?source=copy_link
- https://vuldb.com/?ctiid.311621
- https://vuldb.com/?id.311621
- https://vuldb.com/?submit.591980
- https://www.tenda.com.cn/
- https://lavender-bicycle-a5a.notion.site/Tenda-AC7-formSetPPTPUserList-20a53a41781f806ca124cbdf99bff931
