CVE-2025-9087
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Tenda AC20 routers via a stack-based buffer overflow in the SetNetControlList endpoint. Attackers can exploit this without authentication to potentially take full control of affected devices. All users running the vulnerable firmware version are affected.
💻 Affected Systems
- Tenda AC20
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, lateral movement to other devices, and botnet recruitment.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or use the device as a pivot point for further attacks.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access, though internal network exposure remains.
🎯 Exploit Status
Python exploit script is publicly available, making exploitation trivial for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates 2. Download latest firmware 3. Access router admin panel 4. Navigate to firmware upgrade section 5. Upload and apply new firmware 6. Reboot router
🔧 Temporary Workarounds
Disable remote administration
allPrevent external access to router web interface
Network segmentation
allIsolate router management interface to separate VLAN
🧯 If You Can't Patch
- Replace affected router with different model/brand
- Place router behind firewall with strict inbound rules blocking all WAN access to management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin panel under System Status or Firmware Upgrade sectionCheck Version:
curl -s http://router-ip/goform/getStatus | grep version or check web interfaceVerify Fix Applied:
Verify firmware version is no longer 16.03.08.12 after update📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/SetNetControlList
- Multiple failed buffer overflow attempts
- Unexpected process crashes or reboots
Network Indicators:
- HTTP POST requests with unusually long 'list' parameter to router IP
- Traffic patterns suggesting exploit delivery
SIEM Query:
source="router_logs" AND (uri="/goform/SetNetControlList" OR method="POST" AND uri CONTAINS "SetNetControlList")