CVE-2025-60337
📋 TL;DR
A buffer overflow vulnerability exists in Tenda AC6 V2.0 routers in the SetSpeedWan function's speed_dir parameter. Attackers can exploit this by sending specially crafted input to cause a Denial of Service (DoS), potentially crashing the router. This affects users running the vulnerable firmware version.
💻 Affected Systems
- Tenda AC6 V2.0
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete router compromise, persistent backdoor installation, or permanent device bricking requiring hardware replacement.
Likely Case
Denial of Service causing router reboot or crash, disrupting network connectivity for all connected devices until manual restart.
If Mitigated
Limited to temporary service interruption if proper network segmentation and monitoring are in place.
🎯 Exploit Status
Proof of concept available on GitHub demonstrates DoS exploitation; buffer overflow could potentially be leveraged for code execution with additional effort.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda's official website for firmware updates. 2. Download the latest firmware for AC6 V2.0. 3. Log into router admin interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install the new firmware. 6. Reboot the router.
🔧 Temporary Workarounds
Disable WAN Management
allPrevent external access to router management interface to block internet-based attacks.
Network Segmentation
allIsolate router management interface to trusted internal network segments only.
🧯 If You Can't Patch
- Replace vulnerable router with updated model or different vendor
- Implement strict firewall rules blocking all external access to router management ports
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or System Tools.Check Version:
Login to router web interface and navigate to System Status page.Verify Fix Applied:
Verify firmware version has changed from 15.03.06.50 to a newer version.📡 Detection & Monitoring
Log Indicators:
- Router crash/reboot logs
- Unusual traffic to router management interface
- Failed authentication attempts on admin interface
Network Indicators:
- Unusual HTTP POST requests to router management endpoints
- Traffic patterns matching known exploit payloads
SIEM Query:
source="router_logs" AND (event="crash" OR event="reboot") OR http_method="POST" AND uri="/goform/SetSpeedWan"