CVE-2025-9297
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Tenda i22 routers by exploiting a stack-based buffer overflow in the web interface. Attackers can send specially crafted requests to the /goform/wxportalauth endpoint to gain control of affected devices. All users running Tenda i22 firmware version 1.0.0.3(4687) are vulnerable.
💻 Affected Systems
- Tenda i22
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, lateral movement to other devices, and botnet recruitment.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or use the device as a pivot point for further attacks.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering, though internal network compromise remains possible.
🎯 Exploit Status
Public proof-of-concept code exists in GitHub repositories, making exploitation straightforward for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda's official website for firmware updates. 2. If available, download the latest firmware. 3. Access router admin interface. 4. Navigate to firmware upgrade section. 5. Upload and apply the update. 6. Reboot the router.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to the router's web interface by disabling remote management features.
Network segmentation and firewall rules
allIsolate affected routers in separate network segments and implement strict firewall rules to limit access to management interfaces.
🧯 If You Can't Patch
- Replace affected routers with different models or brands that receive security updates
- Implement network monitoring and intrusion detection specifically for buffer overflow attempts against the /goform/wxportalauth endpoint
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface or using nmap to identify Tenda i22 devices running version 1.0.0.3(4687).Check Version:
Check router web interface at http://[router-ip]/ or use telnet/ssh if available to check version information.Verify Fix Applied:
Verify firmware version has been updated to a version later than 1.0.0.3(4687) through the router admin interface.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/wxportalauth with manipulated Type parameter
- Router crash or reboot logs
- Unusual outbound connections from router
Network Indicators:
- HTTP requests to router IP on port 80/443 with buffer overflow patterns in Type parameter
- Sudden changes in router configuration
SIEM Query:
source="router_logs" AND (url="/goform/wxportalauth" OR url="/goform/wxportalauth") AND (param="Type" OR payload_size>normal)🔗 References
- https://github.com/davybat/IoT-Vuls/blob/main/tenda/formWeixinAuthInfoGet.md
- https://github.com/davybat/IoT-Vuls/blob/main/tenda/formWeixinAuthInfoGet.md#poc
- https://vuldb.com/?ctiid.320902
- https://vuldb.com/?id.320902
- https://vuldb.com/?submit.632332
- https://www.tenda.com.cn/
- https://github.com/davybat/IoT-Vuls/blob/main/tenda/formWeixinAuthInfoGet.md
- https://github.com/davybat/IoT-Vuls/blob/main/tenda/formWeixinAuthInfoGet.md#poc
