Ac6 Firmware CVE-2025-46035

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector with low complexity and no privileges required—strong indicators of real-world exploitability. However, the confidentiality impact (C:H) in the CVSS vector conflicts with the DoS-only description provided, suggesting either a documentation error or that the vulnerability has secondary info disclosure properties not explicitly described. The denial of service impact (A:N per description vs. the CVSS implications) is the primary confirmed threat. Without publicly disclosed POC code or KEV catalog inclusion, the EPSS score is likely moderate (0.4-0.6 range for unpatched consumer IoT devices). The real risk is moderate-to-high for organizations with Tenda AC6 deployments in critical network roles, but lower for isolated consumer use since rebooting a router is a minor inconvenience. This is not a remote code execution vulnerability and does not enable lateral movement; it is primarily a nuisance attack vector against consumer router availability.

An attacker on the same network segment (or with internet access if WAN management is enabled) crafts an HTTP GET request to http://[router-ip]/goform/openSchedWifi?schedStartTime=[1000-byte-payload]&schedEndTime=[1000-byte-payload]. The router's firmware parses these parameters without length validation, overflowing a fixed-size buffer in the schedule processing function. This causes the HTTP daemon to crash or restart, temporarily disabling the router's web interface and potentially affecting Wi-Fi connectivity. A simple script can automate this to repeatedly crash the router every 30 seconds, creating a denial of service condition. No authentication or user interaction is required. An attacker could script this to target multiple Tenda AC6 routers on a network segment to cause widespread outages. This is a low-skill attack with no prerequisites beyond network access.