CVE-2025-0528: Tenda AC8 Firmware RCE Vulnerability

CVE-2025-0528 Overview

CVE-2025-0528 is a command injection vulnerability affecting Tenda AC8, AC10, and AC18 wireless routers running firmware version 16.03.10.20. The flaw resides in the HTTP Request Handler component and is triggered through the /goform/telnet endpoint. Attackers can manipulate request parameters to inject operating system commands that the device executes with elevated privileges. The issue has been publicly disclosed, and exploit details are available in a third-party GitHub repository. The vulnerability is tracked under [CWE-78] (OS Command Injection) and [CWE-74] (Improper Neutralization of Special Elements).

Critical Impact
Remote attackers with valid credentials can execute arbitrary operating system commands on affected Tenda routers, leading to full device compromise and potential pivot into adjacent networks.

Affected Products

Tenda AC8 with firmware 16.03.10.20
Tenda AC10 with firmware 16.03.10.20
Tenda AC18 with firmware 16.03.10.20

Discovery Timeline

2025-01-17 - CVE-2025-0528 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0528

Vulnerability Analysis

The vulnerability exists in the web management interface of Tenda AC8, AC10, and AC18 routers. The /goform/telnet handler processes HTTP requests but fails to sanitize user-supplied input before passing it to a system shell. As a result, shell metacharacters embedded in request parameters are interpreted by the underlying operating system. Successful exploitation grants the attacker command execution on the router, typically as root, because embedded Linux web daemons on consumer routers run with the highest privilege level.

The Exploit Prediction Scoring System places this issue in the top tier for likelihood of exploitation, reflecting the public availability of technical write-ups and the broad deployment of Tenda consumer hardware.

Root Cause

The root cause is missing input neutralization in the HTTP form handler that backs the telnet configuration feature. Request parameters intended to enable or configure the telnet service are concatenated into a shell command without escaping or whitelisting. This pattern matches classic OS command injection described by [CWE-78].

Attack Vector

The attack is remote and network-based. An attacker who reaches the router's HTTP management interface and possesses high-privilege credentials can send a crafted POST request to /goform/telnet that embeds shell metacharacters such as ;, |, or backticks. The router executes the injected command as part of its telnet handling routine. Public proof-of-concept material is hosted in a GitHub IoT research repository, and entries exist in the VulDB Report #292412 and VulDB Details #292412 databases.

No verified code examples are reproduced here. Refer to the linked references for technical exploitation details.

Detection Methods for CVE-2025-0528

Indicators of Compromise

Unexpected POST requests to the /goform/telnet endpoint in router HTTP access logs.
Telnet service (TCP/23) listening on the router after the request, when it was previously disabled.
Outbound connections from the router to unknown hosts following administrative HTTP traffic.
Presence of shell metacharacters (;, |, `, $()) in form parameters submitted to management URLs.

Detection Strategies

Inspect HTTP traffic destined for router management interfaces for requests matching the /goform/telnet path containing non-alphanumeric payload data.
Alert on telnet daemon activation events on network devices that are policy-restricted to HTTPS-only management.
Correlate authentication events to the router admin interface with subsequent service state changes.

Monitoring Recommendations

Forward router syslog and HTTP access logs to a central log platform for retention and analysis.
Track listening ports on managed network devices using periodic Nmap or SNMP sweeps.
Monitor for new processes or unexpected outbound DNS queries originating from router subnets.

How to Mitigate CVE-2025-0528

Immediate Actions Required

Disable remote WAN-side administration on Tenda AC8, AC10, and AC18 devices.
Restrict LAN-side management access to a dedicated administrative VLAN or trusted host list.
Rotate all router administrative credentials and enforce strong, unique passwords.
Audit router configuration for unauthorized telnet, SSH, or port forwarding entries.

Patch Information

At the time of publication, no vendor advisory or firmware update from Tenda is referenced in the CVE record. Monitor the Tenda official site for firmware releases addressing the 16.03.10.20 baseline on AC8, AC10, and AC18 models. Until a fixed firmware is available, the workarounds below should be applied.

Workarounds

Place affected routers behind an upstream firewall and block inbound HTTP/HTTPS access to the management interface from untrusted networks.
Disable the telnet feature in the router web UI and verify TCP/23 is closed externally.
Replace end-of-life Tenda models with firmware that receives active security maintenance if a patch does not materialize.
Segment IoT and consumer-grade networking equipment from sensitive corporate or operational assets.

bash

# Example: block external access to the router management interface from an upstream firewall
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 23 -j DROP