Overview
A critical vulnerability has been discovered in Tenda AC21 and AC23 routers, specifically in the 16.03.08.16 version. This security flaw, identified as CVE-2025-9605, exposes the routers to remote attacks, potentially leading to system compromise and data leakage. Given that Tenda routers are widely used globally, this vulnerability poses a significant risk to millions of Internet users, making it a matter of grave concern.
Vulnerability Summary
CVE ID: CVE-2025-9605
Severity: Critical (9.8 CVSS Severity Score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Tenda AC21| 16.03.08.16
Tenda AC23| 16.03.08.16
How the Exploit Works
The vulnerability lies in the GetParentControlInfo function of the file /goform/GetParentControlInfo. The attack is based on manipulating the ‘mac’ argument, which causes a stack-based buffer overflow. A buffer overflow occurs when more data is written into a block of memory, or buffer, than it can hold. In this case, the overflow occurs in the stack, a region of memory used for static data and local variables.
An attacker can exploit this vulnerability by sending specially crafted input to the affected function, causing the system to crash or execute arbitrary code. Since the attack can be launched remotely, the attacker does not need physical access to the device, making it easier to exploit and harder to detect.
Conceptual Example Code
Given below is a conceptual example of how the vulnerability might be exploited. This is an HTTP POST request with a malicious payload, designed to exploit the buffer overflow vulnerability:
POST /goform/GetParentControlInfo HTTP/1.1
Host: target_router_ip
Content-Type: application/json
{ "mac": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..." }In this example, the ‘mac’ argument is overfilled with ‘A’s. This causes a buffer overflow in the target system, potentially crashing it or allowing the execution of arbitrary code.
Mitigation Guidance
Users of affected Tenda routers are strongly advised to apply the vendor patch as soon as possible. In the interim, Web Application Firewalls (WAF) or Intrusion Detection Systems (IDS) may serve as temporary mitigation measures. However, these are not long-term solutions and can only reduce the risk of exploit, not eliminate it. Therefore, applying the vendor patch remains the most effective way to secure systems against this vulnerability.
