CVE-2025-60661
📋 TL;DR
A stack overflow vulnerability in Tenda AC18 routers allows attackers to execute arbitrary code or cause denial of service by sending specially crafted requests to the cloneType parameter. This affects users running Tenda AC18 firmware version 15.03.05.19. The vulnerability requires network access to the router's web interface.
💻 Affected Systems
- Tenda AC18
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete router compromise, credential theft, network traffic interception, and lateral movement into connected devices.
Likely Case
Router crash/reboot causing temporary denial of service, requiring physical reset to restore functionality.
If Mitigated
No impact if router is not exposed to untrusted networks and firmware is updated.
🎯 Exploit Status
The Google Drive reference contains technical details and likely includes proof-of-concept code. Exploitation requires access to the router's web interface but may not require authentication depending on configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates
2. Download latest firmware for AC18
3. Access router web interface
4. Navigate to System Tools > Firmware Upgrade
5. Upload and install new firmware
6. Reboot router after installation
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Restrict LAN Access
allUse firewall rules to limit which devices can access router management interface
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict access controls
- Implement network monitoring for exploitation attempts against router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Status or System Tools > Firmware UpgradeCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is no longer V15.03.05.19 after update📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/advSetMacMtuWan with large cloneType parameter
- Router crash/reboot events in system logs
Network Indicators:
- HTTP requests with unusually long cloneType parameter values to router IP
- Traffic patterns suggesting buffer overflow exploitation
SIEM Query:
source="router_logs" AND (uri_path="/goform/advSetMacMtuWan" AND content_length>1000)