CVE-2025-7544
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda AC1206 routers allows remote attackers to execute arbitrary code by manipulating the deviceList parameter in the formSetMacFilterCfg function. This affects users running firmware version 15.03.06.23. Successful exploitation could lead to complete device compromise.
💻 Affected Systems
- Tenda AC1206
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full router compromise, credential theft, network traffic interception, and lateral movement into connected devices.
Likely Case
Router takeover enabling DNS hijacking, credential harvesting, and persistent backdoor installation.
If Mitigated
Limited impact if routers are behind firewalls with strict inbound filtering and MAC filtering disabled.
🎯 Exploit Status
Proof-of-concept exploit code is publicly available on GitHub. Attack requires network access to router's web interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. If update available, download and upload via router web interface. 3. Reboot router after update.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Access router admin panel -> Advanced -> System Tools -> Remote Management -> Disable
Block Web Interface Ports
linuxFirewall rules to block access to router management ports
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict access controls
- Implement network monitoring for exploit attempts and anomalous traffic
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface: Login -> Advanced -> System Tools -> Firmware UpgradeCheck Version:
curl -s http://router-ip/ | grep -i firmwareVerify Fix Applied:
Verify firmware version is newer than 15.03.06.23📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/setMacFilterCfg
- Large deviceList parameter values in web logs
- Router reboot events
Network Indicators:
- Multiple failed login attempts followed by POST to vulnerable endpoint
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND uri="/goform/setMacFilterCfg" AND method="POST" AND size(deviceList)>100🔗 References
- https://github.com/panda666-888/vuls/blob/main/tenda/ac1206/formSetMacFilterCfg.md
- https://github.com/panda666-888/vuls/blob/main/tenda/ac1206/formSetMacFilterCfg.md#poc
- https://vuldb.com/?ctiid.316241
- https://vuldb.com/?id.316241
- https://vuldb.com/?submit.614089
- https://www.tenda.com.cn/
- https://github.com/panda666-888/vuls/blob/main/tenda/ac1206/formSetMacFilterCfg.md
