EUVD-2025-17379
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability, which was classified as critical, has been found in Tenda AC9 15.03.02.13. Affected by this issue is the function fromadvsetlanip of the file /goform/AdvSetLanip of the component POST Request Handler. The manipulation of the argument lanMask leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Analysis
A critical buffer overflow vulnerability exists in Tenda AC9 router firmware version 15.03.02.13, affecting the POST request handler for LAN IP configuration. An authenticated attacker can exploit the lanMask parameter in the /goform/AdvSetLanip endpoint to trigger a buffer overflow, achieving remote code execution with full system compromise (confidentiality, integrity, and availability impact). Public exploit code is available and the vulnerability is actively exploitable with authenticated access.
Technical Context
The vulnerability exists in the fromadvsetlanip function within the POST request handler component of Tenda AC9 wireless router firmware. The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow flaw where user-supplied input (lanMask parameter) is not properly validated before being written to a fixed-size buffer. The affected CPE is cpe:2.3:o:tenda:ac9_firmware:15.03.02.13:*:*:*:*:*:*:*. This is a network device management interface vulnerability where the web-based configuration endpoint fails to sanitize or bounds-check the lanMask input, allowing an attacker to overflow the buffer and potentially execute arbitrary code with the privileges of the web service (typically root on embedded systems).
Affected Products
- vendor: Tenda; product: AC9 Wireless Router; affected_version: 15.03.02.13; cpe: cpe:2.3:o:tenda:ac9_firmware:15.03.02.13:*:*:*:*:*:*:*; affected_component: /goform/AdvSetLanip (POST request handler, fromadvsetlanip function); notes: Firmware versions prior to a patched release are presumed vulnerable; exact patch version not specified in available data
Remediation
patch: Download and apply the latest Tenda AC9 firmware from https://www.tendacn.com/ or your regional Tenda support portal access_control_mitigation: Disable remote management (WAN access to web interface), use a strong, unique administrative password, and restrict LAN access to the management interface if possible through firewall rules monitoring: Enable router logging if available; monitor HTTP POST requests to /goform/AdvSetLanip for unusually long lanMask parameter values temporary_workaround: If management must be retained, access only over a trusted LAN segment or VPN
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today