CVE-2025-60340
📋 TL;DR
This vulnerability allows attackers to cause denial of service on Tenda AC6 routers by exploiting buffer overflows in the SetClientState function. Attackers can inject crafted payloads into specific parameters to crash the device. This affects users running vulnerable firmware versions of Tenda AC6 routers.
💻 Affected Systems
- Tenda AC6
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router crash requiring physical reset, potential remote code execution if memory corruption leads to arbitrary code execution
Likely Case
Router becomes unresponsive, requiring reboot and disrupting network connectivity
If Mitigated
Limited to DoS impact with proper network segmentation and access controls
🎯 Exploit Status
Public PoC available on GitHub. Exploit appears straightforward with crafted HTTP requests to vulnerable parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates
2. Download latest firmware for AC6 model
3. Access router web interface
4. Navigate to System Tools > Firmware Upgrade
5. Upload and apply new firmware
6. Reboot router after update
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router web interface
Network segmentation
allIsolate router management interface to trusted network segment
🧯 If You Can't Patch
- Replace vulnerable router with different model/brand
- Implement strict firewall rules to block access to router management interface from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Status or System ToolsCheck Version:
Check router web interface or use: curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is updated beyond v15.03.06.50📡 Detection & Monitoring
Log Indicators:
- Multiple failed HTTP requests to /goform/SetClientState
- Router crash/reboot events in system logs
- Unusual payloads in limitSpeed, deviceId, or limitSpeedUp parameters
Network Indicators:
- HTTP POST requests to /goform/SetClientState with unusually long parameter values
- Traffic patterns indicating DoS attempts against router management interface
SIEM Query:
source="router_logs" AND (uri_path="/goform/SetClientState" AND (param_length>100 OR status_code=500))