CVE-2025-5900
📋 TL;DR
This CSRF vulnerability in Tenda AC9 routers allows attackers to trick authenticated users into performing unauthorized actions like rebooting or restoring factory settings. It affects users of Tenda AC9 routers with firmware version 15.03.02.13. The attack can be launched remotely through malicious web pages.
💻 Affected Systems
- Tenda AC9
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Router becomes unavailable due to repeated reboots or loses all configuration after factory reset, causing network downtime and requiring physical access to reconfigure.
Likely Case
Temporary network disruption from router reboot or loss of custom settings after factory reset, requiring reconfiguration.
If Mitigated
No impact if CSRF protections are enabled or if router is not internet-facing.
🎯 Exploit Status
Exploit requires user to visit malicious webpage while logged into router admin. Proof-of-concept available in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
Check Tenda website for firmware updates. If available, download and flash via web interface.
🔧 Temporary Workarounds
Enable CSRF Protection
allAdd CSRF tokens if router firmware supports it (unlikely in affected version)
Logout After Configuration
allAlways log out of router admin interface after making changes
🧯 If You Can't Patch
- Change router admin password to complex value
- Disable remote management/WAN access to admin interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin panel > System StatusCheck Version:
Login to router web interface and navigate to System Status pageVerify Fix Applied:
Verify firmware version is newer than 15.03.02.13📡 Detection & Monitoring
Log Indicators:
- Multiple reboot or factory reset events in short time
- Admin actions from unexpected IP addresses
Network Indicators:
- HTTP POST requests to /goform/SysToolReboot or /goform/SysToolRestoreSet without referrer validation
SIEM Query:
source="router" AND (event="reboot" OR event="factory_reset") AND count > 2 within 5m🔗 References
- https://candle-throne-f75.notion.site/Tenda-AC9-fromSysToolReboot-20adf0aa1185806a9d20ee5c355c08a6?pvs=73
- https://candle-throne-f75.notion.site/Tenda-AC9-fromSysToolRestoreSet-20adf0aa11858094a25ae21f9b4203da
- https://vuldb.com/?ctiid.311673
- https://vuldb.com/?id.311673
- https://vuldb.com/?submit.592198
- https://vuldb.com/?submit.592199
- https://www.tenda.com.cn/
- https://candle-throne-f75.notion.site/Tenda-AC9-fromSysToolRestoreSet-20adf0aa11858094a25ae21f9b4203da
