CVE-2025-10443: Tenda AC9 Buffer Overflow Vulnerability

CVE-2025-10443 Overview

CVE-2025-10443 is a buffer overflow vulnerability affecting Tenda AC9 and AC15 wireless routers running firmware versions 15.03.05.14 and 15.03.05.18. The flaw resides in the formexeCommand function within /goform/exeCommand, where improper handling of the cmdinput argument allows attackers to overflow a fixed-size buffer. The vulnerability is remotely exploitable over the network and requires only low-privilege access. A public proof-of-concept has been published, increasing the likelihood of opportunistic exploitation against exposed router management interfaces. The weakness is categorized under [CWE-119], improper restriction of operations within the bounds of a memory buffer.

Critical Impact
Remote attackers with low-privilege credentials can trigger memory corruption in the router's HTTP management interface, enabling code execution or full device compromise.

Affected Products

Tenda AC9 firmware 15.03.05.14
Tenda AC15 firmware 15.03.05.18
Tenda AC9 and AC15 hardware appliances running the affected firmware

Discovery Timeline

2025-09-15 - CVE-2025-10443 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10443

Vulnerability Analysis

The vulnerability exists in the formexeCommand handler exposed through the /goform/exeCommand endpoint on the router's built-in HTTP server. The handler reads the cmdinput HTTP parameter and copies it into a fixed-size stack buffer without validating the input length. Supplying an oversized value overwrites adjacent stack memory, including saved return addresses and function pointers. Because Tenda's firmware runs the web server as a privileged process on a MIPS-based embedded platform with limited exploit mitigations, memory corruption in this code path leads directly to arbitrary code execution on the device. The Exploit Prediction Scoring System places this issue in the top tier of likely exploited vulnerabilities, reflecting both the public proof-of-concept and the popularity of the affected consumer routers.

Root Cause

The root cause is a missing length check on the cmdinput parameter before it is passed to an unsafe string copy operation. The handler assumes user-supplied data fits within the destination buffer, which classifies the flaw under [CWE-119]. No canaries, address space layout randomization, or non-executable stack protections are consistently applied across the affected firmware builds.

Attack Vector

An authenticated attacker on the same network segment as the router sends a crafted HTTP POST request to /goform/exeCommand containing an oversized cmdinput value. In deployments where the management interface is reachable from the internet, the attack becomes exploitable remotely without local network access. Successful exploitation corrupts the process stack, redirects execution, and can yield persistent control of the router for traffic interception, DNS hijacking, or use as a botnet node.

The vulnerability manifests when the formexeCommand function copies attacker-controlled data from the cmdinput request parameter into a stack buffer without bounds checking. See the GitHub PoC Repository and VulDB #323877 - Analysis for technical write-ups.

Detection Methods for CVE-2025-10443

Indicators of Compromise

HTTP POST requests to /goform/exeCommand containing unusually long cmdinput parameter values
Unexpected reboots or crashes of the router's httpd process visible in system logs
Outbound connections from the router to unknown command-and-control infrastructure
Configuration changes to DNS settings, administrative credentials, or port-forwarding rules that were not initiated by administrators

Detection Strategies

Deploy network intrusion detection signatures that flag POST requests to /goform/exeCommand where the cmdinput field exceeds a reasonable byte length threshold
Monitor HTTP traffic targeting the router management interface for repeated requests from a single source, which may indicate exploitation attempts
Correlate router log entries with perimeter firewall logs to identify external hosts probing management endpoints

Monitoring Recommendations

Log all administrative and management-plane access to Tenda routers and forward logs to a centralized SIEM for retention and analysis
Alert on any HTTP request to the /goform/ path from sources outside the trusted management network
Baseline normal router process behavior and alert on unexpected httpd restarts or new listening ports

How to Mitigate CVE-2025-10443

Immediate Actions Required

Restrict access to the router's web management interface to trusted internal hosts only, and disable remote administration from the WAN
Change default administrative credentials and enforce a strong password policy on all affected devices
Segment consumer-grade routers away from sensitive corporate networks until firmware updates are available
Inventory all Tenda AC9 and AC15 devices running firmware 15.03.05.14 or 15.03.05.18 and prioritize them for replacement or mitigation

Patch Information

At the time of publication, no vendor-supplied patch has been referenced in the NVD advisory. Administrators should monitor the Tenda Official Site for firmware updates addressing CVE-2025-10443 and consult VulDB #323877 for advisory status updates.

Workarounds

Block external access to TCP ports 80 and 443 on the router's WAN interface using an upstream firewall
Place the router behind a network access control layer that requires VPN authentication before management traffic can reach it
Replace end-of-life or unpatched Tenda AC9 and AC15 devices with hardware that receives active security maintenance

bash

# Example upstream firewall rule to block WAN-side access to the router management interface
iptables -A FORWARD -d <router-wan-ip> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <router-wan-ip> -p tcp --dport 443 -j DROP