CVE-2025-11123: Tenda AC18 Buffer Overflow Vulnerability

CVE-2025-11123 Overview

CVE-2025-11123 is a stack-based buffer overflow vulnerability in the Tenda AC18 wireless router running firmware version 15.03.05.19. The flaw resides in an unspecified function handling the /goform/saveAutoQos endpoint, where the enable argument is processed without proper bounds checking [CWE-119]. Attackers can exploit this remotely over the network to corrupt the stack and potentially execute arbitrary code on the device. A proof-of-concept exploit has been published, increasing the likelihood of opportunistic targeting against exposed devices. The vulnerability was published to the National Vulnerability Database (NVD) on September 28, 2025.

Critical Impact
Remote attackers with low-privilege authentication can trigger a stack-based buffer overflow on Tenda AC18 routers, leading to denial of service or arbitrary code execution on affected network infrastructure.

Affected Products

Tenda AC18 router (hardware)
Tenda AC18 firmware version 15.03.05.19
Deployments exposing the web management interface to untrusted networks

Discovery Timeline

2025-09-28 - CVE-2025-11123 published to NVD
2025-10-03 - Last updated in NVD database

Technical Details for CVE-2025-11123

Vulnerability Analysis

The vulnerability exists in the request handler for /goform/saveAutoQos, an endpoint exposed by the Tenda AC18 web management service. When the handler processes the enable parameter from an HTTP request, it copies the attacker-controlled value into a fixed-size stack buffer without validating the input length. Supplying an overlong enable value overwrites adjacent stack memory, including saved return addresses and frame pointers. The impact extends to confidentiality, integrity, and availability of the device, allowing attackers to crash the router or pivot deeper into the network.

Root Cause

The root cause is improper restriction of operations within the bounds of a memory buffer [CWE-119]. The web server CGI handler in the AC18 firmware uses unsafe string copy operations (such as strcpy or sprintf) on user-supplied parameters without enforcing length limits. This is a recurring pattern in Tenda consumer router firmware, where input validation on /goform/* endpoints is inconsistent.

Attack Vector

The attack vector is network-based and requires low-privilege authentication to the router's HTTP management interface. An attacker sends a crafted POST request to /goform/saveAutoQos containing an oversized enable parameter. If the management interface is exposed to the WAN or accessible from a compromised LAN host, exploitation can be initiated remotely without user interaction. A public proof-of-concept is referenced in the GitHub PoC Repository maintained by the original reporter.

No verified exploitation code is reproduced here. Refer to the VulDB #326204 Details entry for additional technical context.

Detection Methods for CVE-2025-11123

Indicators of Compromise

HTTP POST requests to /goform/saveAutoQos containing unusually long enable parameter values
Unexpected reboots, crashes, or watchdog resets of Tenda AC18 devices coinciding with inbound HTTP traffic
Outbound connections from the router to unknown hosts following management interface access
Authentication events on the router web UI from unfamiliar source IPs

Detection Strategies

Inspect HTTP request logs at the network perimeter for POST requests to /goform/saveAutoQos with parameter lengths exceeding typical values
Apply IDS or IPS signatures that flag oversized parameters in CGI requests directed at Tenda firmware paths
Correlate router crash events with preceding HTTP traffic to identify exploitation attempts

Monitoring Recommendations

Forward router syslog and authentication events to a centralized logging platform for anomaly review
Monitor for unauthorized configuration changes, especially to QoS, DNS, and firewall rules
Alert on any management interface access from outside trusted administrative networks

How to Mitigate CVE-2025-11123

Immediate Actions Required

Disable remote WAN administration on all Tenda AC18 devices until a vendor patch is verified and applied
Restrict LAN-side access to the router management interface to a dedicated administrative VLAN or host
Rotate router administrator credentials and disable any unused service accounts
Inventory all Tenda AC18 deployments running firmware 15.03.05.19 and prioritize replacement or isolation

Patch Information

At the time of publication, no vendor advisory or patched firmware release has been published by Tenda for CVE-2025-11123. Monitor the Tenda Official Website for firmware updates addressing the saveAutoQos handler. Organizations operating affected devices in production environments should consider replacement with hardware that receives active security maintenance.

Workarounds

Place affected routers behind an upstream firewall that blocks inbound HTTP and HTTPS to the management interface
Disable the auto QoS feature where configurable to reduce exposure of the vulnerable code path
Segment IoT and consumer router devices onto isolated network segments with strict egress filtering
Replace end-of-life or unpatched Tenda AC18 units with vendor-supported alternatives in enterprise deployments

bash

# Example: block inbound access to the router management interface using iptables on an upstream gateway
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP