CVE-2025-9523
📋 TL;DR
This vulnerability in Tenda AC1206 routers allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the GetParentControlInfo function. Attackers can exploit this without authentication to potentially take full control of affected devices. All users running the vulnerable firmware version are at risk.
💻 Affected Systems
- Tenda AC1206
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, lateral movement to other devices, and botnet recruitment.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or use the device as a pivot point for further attacks.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access, though internal network exposure remains.
🎯 Exploit Status
Public exploit code is available on GitHub, making exploitation trivial for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware. 3. Log into router admin interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router web interface
Network segmentation
allIsolate router management interface to separate VLAN
🧯 If You Can't Patch
- Replace affected devices with supported models from different vendors
- Implement strict network access controls to limit exposure to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or System Tools > Firmware UpgradeCheck Version:
curl -s http://router-ip/goform/GetParentControlInfo?mac=$(python -c "print('A'*1000)") - check for crash/errorVerify Fix Applied:
Verify firmware version is no longer 15.03.06.23 after update📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/GetParentControlInfo with long mac parameters
- Router crash/reboot logs
- Unusual outbound connections from router
Network Indicators:
- HTTP requests with abnormally long mac parameter values to router IP
- Sudden changes in router configuration
SIEM Query:
source="router_logs" AND uri_path="/goform/GetParentControlInfo" AND uri_query="*mac=*" AND length(uri_query) > 100