CVE-2025-70650
📋 TL;DR
CVE-2025-70650 is a stack overflow vulnerability in Tenda AX-1806 routers that allows attackers to cause a Denial of Service (DoS) by sending specially crafted requests to the deviceList parameter. This affects all users running Tenda AX-1806 v1.0.0.1 firmware, potentially rendering their routers unresponsive.
💻 Affected Systems
- Tenda AX-1806
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router crash requiring physical power cycle, disrupting all network connectivity for connected devices.
Likely Case
Router becomes unresponsive to legitimate requests, requiring reboot to restore functionality.
If Mitigated
Limited impact if router is behind firewall with restricted access to management interface.
🎯 Exploit Status
Public proof-of-concept available on GitHub, exploitation requires sending crafted HTTP request to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates 2. Download latest firmware 3. Upload via router web interface 4. Reboot router
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router management interface
Restrict Management Interface Access
allConfigure firewall to only allow management access from trusted IPs
🧯 If You Can't Patch
- Isolate router on separate VLAN with restricted access
- Implement network monitoring for DoS attempts against router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface or via SSH if availableCheck Version:
Check router web interface at 192.168.0.1 or 192.168.1.1 for firmware versionVerify Fix Applied:
Verify firmware version is updated beyond v1.0.0.1📡 Detection & Monitoring
Log Indicators:
- Multiple failed HTTP requests to /goform/setMacFilterCfg
- Router crash/reboot logs
Network Indicators:
- Unusual HTTP POST requests to router management interface with large deviceList parameter
SIEM Query:
source="router_logs" AND (uri="/goform/setMacFilterCfg" OR message="crash" OR message="reboot")