EUVD-2025-21340
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability classified as critical has been found in Tenda AX1803 1.0.0.1. Affected is the function formSetMacFilterCfg of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-7597 is a critical stack-based buffer overflow vulnerability in Tenda AX1803 router firmware (version 1.0.0.1) affecting the MAC filter configuration function. An authenticated attacker can remotely exploit this via the deviceList parameter to achieve remote code execution with full system compromise (confidentiality, integrity, availability). A public exploit has been disclosed and the vulnerability may be actively exploited.
Technical Context
The vulnerability exists in the formSetMacFilterCfg function within the /goform/setMacFilterCfg web interface handler on Tenda AX1803 routers. The root cause is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), specifically a stack-based buffer overflow. The deviceList parameter lacks proper bounds checking when processed by the CGI handler, allowing an attacker to write beyond allocated stack memory. This is a classic memory safety issue in embedded device firmware, likely written in C/C++ without modern compiler protections or runtime bounds checking. The attack surface is the web management interface accessible after authentication, making it part of the device's HTTP server component.
Affected Products
Tenda AX1803 firmware version 1.0.0.1 and potentially earlier versions. The affected device is a dual-band AC router (AX1803 designation suggests AC1200/similar specs). CPE would be: cpe:2.3:o:tenda:ax1803_firmware:1.0.0.1:*:*:*:*:*:*:*. The vulnerability affects the web-based management interface accessible on the LAN/WAN depending on configuration. Other Tenda AX and router models with similar code architecture may be vulnerable; Tenda has historically had multiple CGI handler vulnerabilities in similar product lines.
Remediation
Immediate remediation options: (1) **Firmware patch**: Check Tenda's support website for AX1803 firmware updates newer than 1.0.0.1. Apply the latest available firmware version immediately. (2) **Access controls**: Restrict access to the web management interface (typically port 80/443) using firewall rules—disable WAN access if not required, limit LAN access to trusted systems. (3) **Credential hardening**: Change default admin credentials immediately if not already done. (4) **Network segmentation**: Isolate router management traffic from general user network traffic. (5) **Vendor contact**: Contact Tenda support to confirm patch availability timeline if not yet released. (6) **Temporary mitigation**: If patching is delayed, disable remote management access and restrict local access to trusted administrators only. Note: Tenda devices often have slow patching cycles; end-of-life devices may not receive patches.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today