CVE-2025-60660
📋 TL;DR
A stack overflow vulnerability in Tenda AC18 routers allows attackers to execute arbitrary code by sending specially crafted requests to the vulnerable function. This affects Tenda AC18 router users running firmware version 15.03.05.19. Successful exploitation could lead to complete device compromise.
💻 Affected Systems
- Tenda AC18
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full router compromise, credential theft, network traffic interception, and lateral movement into connected devices.
Likely Case
Router crash/reboot causing denial of service, or limited code execution allowing attacker persistence on the device.
If Mitigated
No impact if device is not internet-facing and network segmentation prevents access to the vulnerable interface.
🎯 Exploit Status
The Google Drive reference contains technical details that could be used to create an exploit. Stack overflow vulnerabilities in embedded devices are frequently weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: Yes
Instructions:
1. Check Tenda's official website for firmware updates. 2. Download the latest firmware for AC18. 3. Access router admin panel. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install the new firmware. 6. Wait for router to reboot.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router management interface
Network Segmentation
allIsolate router management interface to trusted network only
🧯 If You Can't Patch
- Replace the vulnerable router with a different model that receives security updates
- Place router behind a firewall that blocks all traffic to the vulnerable service/port
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin panel under System Status or System ToolsCheck Version:
Login to router admin panel and check System Status pageVerify Fix Applied:
Verify firmware version is newer than V15.03.05.19 after update📡 Detection & Monitoring
Log Indicators:
- Unusual requests to router management interface
- Router crash/reboot logs
- Failed authentication attempts followed by exploit-like patterns
Network Indicators:
- Unusual traffic to router management ports (typically 80/443)
- Malformed HTTP requests containing long mac parameter values
SIEM Query:
source="router_logs" AND ("fromAdvSetMacMtuWan" OR "mac parameter" OR "stack overflow")