Ac9 Firmware CVE-2025-5839

This vulnerability presents a HIGH real-world risk despite some mitigating factors. CVSS 8.8 (High) reflects the severity accurately: attack vector is Network, attack complexity is Low, but requires Low privilege (authenticated user). The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates maximum impact on confidentiality, integrity, and availability. The authentication requirement (PR:L) reduces the attack surface compared to unauthenticated exploits, but many Tenda routers have default credentials or credential exposure. Public exploit disclosure significantly increases real-world risk. EPSS assessment would likely be MODERATE-to-HIGH given the public POC availability, though the authentication requirement prevents this from being a worm-capable critical vulnerability. This router is commonly deployed in small office/home office environments where administrative credentials may be weak or unchanged. The router's role as a network perimeter device makes compromise particularly dangerous—an attacker gains LAN visibility and can pivot to internal systems.

An attacker with access to the router's network (either on the LAN or having compromised a device with LAN access) connects to the Tenda AC9 web management interface at http://[router-ip]:80. After authenticating using default credentials (admin/admin) or previously compromised credentials, the attacker crafts a POST request to /goform/AdvSetLanip with an oversized lanMask parameter containing shellcode or ROP gadgets. The buffer overflow overwrites adjacent memory, potentially hijacking control flow to execute arbitrary code. Successful exploitation grants the attacker remote code execution with root privileges on the router, enabling them to: intercept LAN traffic, modify DNS settings, inject malware, pivot to internal network systems, or create a persistent backdoor. Public exploit code reduces the technical skill barrier significantly—even novice attackers can leverage published tools. The low attack complexity and widespread deployment of Tenda AC9 routers make this a practical attack vector in real-world security incidents.