CVE-2025-11356: Tenda AC23 Buffer Overflow Vulnerability

CVE-2025-11356 Overview

CVE-2025-11356 is a buffer overflow vulnerability in the Tenda AC23 wireless router firmware versions up to and including 16.03.07.52. The flaw resides in the sscanf function within the /goform/SetStaticRouteCfg endpoint. Attackers can manipulate the list argument to trigger memory corruption over the network. Public disclosure of the exploit details increases the risk of opportunistic attacks against exposed devices. The vulnerability is classified under [CWE-119] for improper restriction of operations within memory buffer bounds.

Critical Impact
Remote attackers with low privileges can corrupt memory on affected Tenda AC23 routers, potentially leading to arbitrary code execution or device compromise.

Affected Products

Tenda AC23 router (hardware)
Tenda AC23 firmware versions up to 16.03.07.52
Devices exposing the /goform/SetStaticRouteCfg web management endpoint

Discovery Timeline

2025-10-07 - CVE-2025-11356 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11356

Vulnerability Analysis

The vulnerability exists in the static route configuration handler of the Tenda AC23 web management interface. The handler processes HTTP requests to /goform/SetStaticRouteCfg and parses the list parameter using the sscanf function. The implementation fails to validate or bound the length of input data before copying it into a fixed-size stack buffer. This permits adjacent memory to be overwritten when a crafted list value exceeds buffer capacity.

Buffer overflows of this class on embedded MIPS or ARM router firmware frequently allow attackers to overwrite saved return addresses or function pointers. The result is hijacked control flow within the router's HTTP daemon. Successful exploitation can yield arbitrary command execution at the privilege level of the web server process, which typically runs as root on consumer routers.

Exploit details have been published, increasing the risk of automated scanning and weaponization. The EPSS probability indicates measurable real-world exploitation likelihood.

Root Cause

The root cause is improper input validation in the use of sscanf to parse user-controlled data into fixed-size buffers. The sscanf format specifiers used by the handler do not enforce maximum field width, allowing unbounded copy operations. This pattern is a well-documented anti-pattern in C-based embedded network services.

Attack Vector

Exploitation requires network access to the router's HTTP management interface and low-privilege authentication. An attacker submits a POST request to /goform/SetStaticRouteCfg containing an oversized list parameter. The malformed value triggers stack corruption during sscanf parsing. The vulnerability does not require user interaction beyond the authenticated request.

For technical reproduction details, see the GitHub CVE Documentation and VulDB Entry #327241.

Detection Methods for CVE-2025-11356

Indicators of Compromise

HTTP POST requests to /goform/SetStaticRouteCfg containing abnormally long list parameter values
Unexpected restarts or crashes of the router's httpd process visible in syslog forwarding
Outbound connections from the router to unfamiliar hosts following management interface activity
New or modified static routes appearing in router configuration without administrative action

Detection Strategies

Inspect web proxy and firewall logs for requests to /goform/SetStaticRouteCfg originating from non-administrative source IP addresses
Deploy network signatures that flag overlong parameter values in HTTP POST bodies targeting Tenda router management paths
Correlate router syslog events with downstream endpoint telemetry to identify pivot attempts after device compromise

Monitoring Recommendations

Forward router syslog to a centralized log platform and alert on httpd crash signatures
Monitor for management interface access from the WAN side, which should be disabled by default
Baseline DNS and outbound traffic from the router and alert on deviations

How to Mitigate CVE-2025-11356

Immediate Actions Required

Disable remote (WAN-side) management access on the Tenda AC23 device immediately
Restrict LAN-side access to the web management interface to a dedicated administrative VLAN or host
Change default administrative credentials and enforce strong, unique passwords
Place vulnerable routers behind a separate perimeter firewall where feasible

Patch Information

No vendor patch has been published in the available references at the time of NVD publication. Monitor the Tenda Security Page for firmware updates addressing the SetStaticRouteCfg handler. Until a fix is available, treat affected devices as high-risk and consider replacement with a supported model.

Workarounds

Block external access to TCP ports used by the router's HTTP management interface at the upstream firewall
Segment the router from sensitive internal networks to limit lateral movement after compromise
Implement an Access Control List restricting /goform/SetStaticRouteCfg to specific administrative IPs where the device supports it
Replace end-of-support consumer routers with enterprise-grade equipment when long-term mitigation is required

bash

# Example: block external HTTP/HTTPS access to the router management interface
# at an upstream firewall (replace ROUTER_IP with the device address)
iptables -I FORWARD -d ROUTER_IP -p tcp --dport 80 -j DROP
iptables -I FORWARD -d ROUTER_IP -p tcp --dport 443 -j DROP