CVE-2025-70746
📋 TL;DR
A stack overflow vulnerability in Tenda AX-1806 routers allows attackers to cause Denial of Service (DoS) by sending specially crafted requests to the timeZone parameter. This affects all users running Tenda AX-1806 v1.0.0.1 firmware, potentially rendering their routers unresponsive.
💻 Affected Systems
- Tenda AX-1806
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router crash requiring physical power cycle, disrupting all network connectivity for connected devices until reboot.
Likely Case
Router becomes unresponsive to network requests, requiring reboot to restore functionality.
If Mitigated
If isolated from untrusted networks, minimal impact with only authorized users potentially triggering the issue.
🎯 Exploit Status
Public proof-of-concept exists in GitHub repository, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. If update available, download and install via router admin interface. 3. Reboot router after installation.
🔧 Temporary Workarounds
Network Isolation
allRestrict access to router admin interface to trusted internal networks only.
Configure firewall rules to block WAN access to router admin ports (typically 80/443)
🧯 If You Can't Patch
- Replace affected router with different model or vendor
- Implement network segmentation to isolate router from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or Firmware Update section.Check Version:
Check via router web interface or SSH if enabled: cat /proc/version or show version commands may work.Verify Fix Applied:
Verify firmware version has been updated to a version later than v1.0.0.1.📡 Detection & Monitoring
Log Indicators:
- Multiple malformed requests to timeZone parameter
- Router crash/reboot events in system logs
Network Indicators:
- Unusual traffic patterns to router admin interface
- Router becoming unresponsive to legitimate requests
SIEM Query:
source="router_logs" AND (message="*timeZone*" OR message="*crash*" OR message="*reboot*")