CVE-2025-8979
📋 TL;DR
This vulnerability in Tenda AC15 routers allows attackers to bypass firmware update authentication checks, potentially enabling malicious firmware installation. It affects users of Tenda AC15 routers with firmware version 15.13.07.13. The attack requires remote access but has high complexity.
💻 Affected Systems
- Tenda AC15
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing persistent backdoor installation, network traffic interception, and lateral movement to connected devices.
Likely Case
Router compromise leading to network disruption, DNS hijacking, or credential theft from connected devices.
If Mitigated
Limited impact if firmware updates are disabled and network segmentation isolates the router.
🎯 Exploit Status
Exploit details are publicly available but exploitation is described as difficult.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: UNKNOWN
Vendor Advisory: NONE
Restart Required: No
Instructions:
Check Tenda official website for firmware updates. If available, download and install through router admin interface.
🔧 Temporary Workarounds
Disable Remote Firmware Updates
allPrevent unauthorized firmware updates by disabling remote update functionality
Network Segmentation
allIsolate router management interface from untrusted networks
🧯 If You Can't Patch
- Disable WAN-side management access to router admin interface
- Implement network monitoring for unexpected firmware update attempts
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is 15.13.07.13, device is vulnerable.Check Version:
Login to router admin interface and check Firmware/System Status pageVerify Fix Applied:
Verify firmware version has been updated to a version later than 15.13.07.13📡 Detection & Monitoring
Log Indicators:
- Unexpected firmware update attempts
- Authentication failures in firmware update logs
Network Indicators:
- Unusual HTTP POST requests to firmware update endpoints
- Traffic to known exploit repositories
SIEM Query:
source="router_logs" AND (event="firmware_update" OR url="*/goform/firmwareUpdate*")🔗 References
- https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/AC15_Auth.md
- https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/AC15_Inte.md
- https://vuldb.com/?ctiid.319975
- https://vuldb.com/?id.319975
- https://vuldb.com/?submit.628602
- https://vuldb.com/?submit.628603
- https://www.tenda.com.cn/
