CVE-2025-11122 Overview
CVE-2025-11122 is a stack-based buffer overflow vulnerability affecting Tenda AC18 routers running firmware version 15.03.05.19. The flaw resides in the /goform/WizardHandle endpoint, where manipulation of the WAN and mtuvalue arguments triggers memory corruption on the stack. Attackers can exploit the issue remotely over the network, and a public proof-of-concept is available. The vulnerability is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).
Critical Impact
Remote attackers can corrupt stack memory on affected Tenda AC18 routers, potentially achieving arbitrary code execution and full device compromise.
Affected Products
- Tenda AC18 router (hardware)
- Tenda AC18 firmware version 15.03.05.19
- Deployments exposing the /goform/WizardHandle web interface
Discovery Timeline
- 2025-09-28 - CVE-2025-11122 published to NVD
- 2025-10-03 - Last updated in NVD database
Technical Details for CVE-2025-11122
Vulnerability Analysis
The vulnerability exists in the HTTP request handler for the /goform/WizardHandle endpoint within the Tenda AC18 web management service. The handler processes setup wizard parameters, including the WAN mode selector and mtuvalue field, without enforcing length limits on user-supplied input. Supplying oversized values causes the handler to write past the bounds of a fixed-size stack buffer.
Because the affected endpoint is reachable from the LAN-side web interface and, in some deployments, from the WAN, an attacker with network access to the router can trigger the overflow with a single crafted HTTP POST request. Successful exploitation can overwrite return addresses on the stack, enabling control-flow hijacking on the MIPS-based router platform.
Root Cause
The root cause is missing input validation and bounds checking on the WAN and mtuvalue parameters before they are copied into stack-allocated buffers. The handler relies on unsafe string-copy operations rather than length-checked equivalents, allowing attacker-controlled data to corrupt adjacent stack frames.
Attack Vector
Exploitation requires the attacker to send a crafted HTTP request to the router's web management interface targeting /goform/WizardHandle with overlong WAN or mtuvalue values. The attack requires low privileges and no user interaction. Public proof-of-concept material is documented in the GitHub PoC for WizardHandle and a secondary PoC entry. Additional reporting is available in the VulDB #326203 Report.
No verified exploitation code is reproduced here. Refer to the linked references for technical reproduction details.
Detection Methods for CVE-2025-11122
Indicators of Compromise
- HTTP POST requests to /goform/WizardHandle containing abnormally long WAN or mtuvalue parameter values
- Unexpected reboots, web-UI crashes, or httpd process restarts on Tenda AC18 devices
- Outbound connections from the router to unknown infrastructure following suspicious requests
- Unauthorized changes to WAN, DNS, or routing configuration on the device
Detection Strategies
- Inspect router and upstream proxy logs for requests to /goform/WizardHandle originating from untrusted sources
- Apply network-based signatures that flag oversized POST bodies targeting Tenda goform endpoints
- Monitor for repeated malformed HTTP requests aimed at the router management interface
- Correlate device crash or reboot events with preceding HTTP traffic to the management plane
Monitoring Recommendations
- Centralize syslog from network devices and alert on httpd faults or watchdog-triggered reboots
- Baseline normal administrative HTTP traffic and alert on parameter values exceeding expected length
- Track configuration drift on SOHO routers using periodic configuration backups and diffs
How to Mitigate CVE-2025-11122
Immediate Actions Required
- Restrict access to the Tenda AC18 web management interface to trusted internal hosts only
- Disable remote (WAN-side) administration on affected routers
- Segment SOHO routers away from sensitive network zones until patched firmware is available
- Review device logs and configuration for signs of tampering
Patch Information
At the time of publication, no vendor patch is listed in the NVD references for firmware 15.03.05.19. Monitor the Tenda Official Website for updated firmware addressing the /goform/WizardHandle handler, and apply updates immediately when released.
Workarounds
- Block external access to TCP ports used by the router management UI (typically 80/443) at the perimeter
- Place the router behind an upstream firewall and restrict management access to a dedicated admin VLAN
- Replace exposed Tenda AC18 devices with supported hardware if a vendor patch is not forthcoming
- Rotate administrative credentials and Wi-Fi keys after confirming device integrity
# Example: restrict router web UI to a single admin host via upstream firewall (iptables)
iptables -A FORWARD -p tcp -d <ROUTER_IP> --dport 80 -s <ADMIN_HOST_IP> -j ACCEPT
iptables -A FORWARD -p tcp -d <ROUTER_IP> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <ROUTER_IP> --dport 443 -s <ADMIN_HOST_IP> -j ACCEPT
iptables -A FORWARD -p tcp -d <ROUTER_IP> --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
