CVE-2025-60343
📋 TL;DR
This CVE describes multiple buffer overflow vulnerabilities in Tenda AC6 routers that allow attackers to cause denial of service by sending specially crafted payloads to multiple parameters in the AdvSetMacMtuWan function. The vulnerability affects Tenda AC6 router users running vulnerable firmware versions. Attackers can exploit this remotely to crash the router.
💻 Affected Systems
- Tenda AC6
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router crash requiring physical reset, potential for remote code execution if buffer overflow can be controlled precisely
Likely Case
Router becomes unresponsive, requiring reboot to restore functionality
If Mitigated
No impact if router is patched or not exposed to untrusted networks
🎯 Exploit Status
Public PoC available on GitHub, buffer overflow in multiple parameters suggests straightforward exploitation
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates
2. Download latest firmware for AC6 model
3. Access router admin interface
4. Navigate to firmware upgrade section
5. Upload and apply new firmware
6. Wait for router to reboot
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router web interface
Access router admin panel -> System -> Remote Management -> Disable
Network segmentation
allIsolate router management interface from untrusted networks
🧯 If You Can't Patch
- Replace router with different model/brand
- Place router behind firewall with strict access controls to management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or Firmware Upgrade sectionCheck Version:
Check via router web interface or SSH if enabled: cat /proc/version or show version commandsVerify Fix Applied:
Verify firmware version is newer than v.15.03.06.50📡 Detection & Monitoring
Log Indicators:
- Router crash/reboot logs
- Multiple failed connection attempts to router admin interface
- Unusual POST requests to AdvSetMacMtuWan endpoint
Network Indicators:
- Unusual traffic to router port 80/443 from external sources
- Repeated connection attempts to router management interface
SIEM Query:
source_ip=external AND dest_port=80 AND uri_path CONTAINS 'AdvSetMacMtuWan'