Ac9 Firmware EUVD-2025-17397

This vulnerability presents HIGH real-world risk. CVSS 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-accessible, low-complexity exploitation requiring only low privileges (authenticated user). The combination of low attack complexity, no user interaction required, and complete impact across confidentiality, integrity, and availability is severe. Critically, public POC availability and evidence of disclosed exploits dramatically increase exploitation probability. The primary mitigating factor is the PR:L (Low Privilege Required) constraint—the attacker needs valid authentication credentials; however, in many router deployments, default credentials or weak authentication can be compromised. SSVC analysis: Exploitation Status=Public (POC disclosed), Automatable=Yes (buffer overflow exploitation is typically automatable), Technical Impact=Complete (arbitrary code execution). This is a genuine critical priority, not inflated scoring. The firmware-level nature means typical network segmentation may not protect devices that are internet-facing or accessible from compromised internal networks.

An attacker with network access to a Tenda AC9 router (either via WAN if remote management is enabled, or from compromised internal network) authenticates to the admin interface using default or weak credentials. The attacker then crafts a malicious HTTP POST request to /goform/SetRemoteWebCfg with an oversized remoteIp parameter (e.g., >256 bytes) containing shellcode or ROP chain payload. The unvalidated input overflows the stack buffer in formSetSafeWanWebMan, overwriting the return pointer. Upon function return, execution jumps to attacker-controlled code, allowing arbitrary command execution with router privileges. The attacker gains full control of the router, enabling man-in-the-middle attacks, DNS hijacking, botnet enrollment, or lateral network reconnaissance. Given public POC availability and low attack complexity, automated exploitation tools are likely to be developed or may already exist in the wild.