CVE-2025-63458
📋 TL;DR
Tenda AX-1803 routers version 1.0.0.1 contain a stack overflow vulnerability in the timeZone parameter of the form_fast_setting_wifi_set function. Attackers can exploit this to cause Denial of Service (DoS) via specially crafted requests. This affects all users running the vulnerable firmware version.
💻 Affected Systems
- Tenda AX-1803
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router crash requiring physical reboot, potential for remote code execution if stack overflow can be controlled to execute arbitrary code
Likely Case
Router becomes unresponsive, requiring reboot to restore functionality, disrupting network connectivity
If Mitigated
Limited impact if router is behind firewall with restricted access to management interface
🎯 Exploit Status
Exploit details are publicly available in GitHub repository; simple HTTP request can trigger the overflow
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: Yes
Instructions:
Check Tenda website for firmware updates. If available, download latest firmware and upload via router admin interface at 192.168.0.1 or 192.168.1.1.
🔧 Temporary Workarounds
Restrict Management Interface Access
linuxBlock external access to router management interface and restrict internal access to trusted IPs
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Replace router with different model or updated version
- Place router behind firewall that blocks all inbound traffic to management ports
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or Firmware Upgrade sectionCheck Version:
curl -s http://192.168.0.1/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is no longer v1.0.0.1 after update📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by large POST requests to /goform/fast_setting_wifi_set
- Router reboot events in system logs
Network Indicators:
- Unusual HTTP POST requests to router management interface with oversized timeZone parameter
- Sudden loss of router responsiveness
SIEM Query:
source="router.log" AND (url="/goform/fast_setting_wifi_set" AND content_length>1000)