CVE-2025-11389: Tenda AC15 Buffer Overflow Vulnerability

CVE-2025-11389 Overview

CVE-2025-11389 is a stack-based buffer overflow vulnerability in the Tenda AC15 router running firmware version 15.03.05.18. The flaw resides in the /goform/saveAutoQos endpoint, where the enable parameter is processed without proper bounds checking. An attacker can send a crafted HTTP request over the network to corrupt stack memory on the device. The exploit has been publicly released, increasing the risk of in-the-wild abuse against exposed devices. The weakness is tracked as [CWE-119] (improper restriction of operations within the bounds of a memory buffer).

Critical Impact

Remote attackers with low privileges can trigger memory corruption on Tenda AC15 routers, potentially leading to arbitrary code execution or denial of service on the affected devices.

Affected Products

• Tenda AC15 router (hardware)
• Tenda AC15 firmware version 15.03.05.18
• Deployments exposing the router web management interface to untrusted networks

Discovery Timeline

• 2025-10-07 - CVE-2025-11389 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2025-11389

Vulnerability Analysis

The vulnerability exists in an unspecified function handling requests to /goform/saveAutoQos on the Tenda AC15 web management interface. The handler reads the enable argument from the incoming HTTP request and copies it into a fixed-size stack buffer without validating the input length. When the supplied value exceeds the buffer size, adjacent stack memory, including saved return addresses, is overwritten. The exploit primitive enables an attacker to influence control flow on the embedded MIPS or ARM target, depending on hardware revision. Public exploitation details are documented in the GitHub vulnerability writeup and VulDB #327316.

Root Cause

The root cause is missing bounds checking on the enable parameter before it is copied into a stack-allocated buffer. The firmware uses unsafe string handling routines that do not enforce a maximum length. This pattern is common in Tenda's goform request handlers, where attacker-controlled query or POST parameters are passed directly to vulnerable copy operations.

Attack Vector

Exploitation requires network access to the router's HTTP management interface and low-privileged authentication. An attacker sends a POST request to /goform/saveAutoQos containing an overlong enable value. Because the device is typically reachable on the LAN, and in some misconfigured deployments on the WAN, the attack surface is wide. The exploit has been disclosed publicly, eliminating the barrier of independent vulnerability research.

No verified exploitation code is reproduced here. Technical details and proof-of-concept material are available in the GitHub vulnerability exploit document.

Detection Methods for CVE-2025-11389

Indicators of Compromise

• HTTP POST requests to /goform/saveAutoQos containing unusually long enable parameter values
• Unexpected reboots or service crashes on Tenda AC15 devices following inbound web requests
• New or unfamiliar outbound connections originating from the router after suspicious HTTP traffic
• Web server log entries showing repeated requests to QoS configuration endpoints from a single source

Detection Strategies

• Inspect HTTP traffic destined for router management interfaces for oversized POST bodies targeting /goform/ endpoints
• Apply network intrusion detection signatures that flag enable parameter values exceeding typical lengths (e.g., over 128 bytes)
• Correlate router crash or reboot events with preceding HTTP requests from internal hosts

Monitoring Recommendations

• Enable logging on perimeter firewalls for any traffic reaching the router management port from untrusted segments
• Monitor DNS and outbound flow telemetry from the router itself for signs of post-exploitation activity
• Track firmware version inventory across networked Tenda devices to identify vulnerable units

How to Mitigate CVE-2025-11389

Immediate Actions Required

• Restrict access to the Tenda AC15 web management interface to trusted management VLANs only
• Disable remote (WAN-side) administration if it is currently enabled
• Change default and weak administrative credentials to reduce the chance of low-privileged access being obtained
• Audit router logs for prior requests to /goform/saveAutoQos from unexpected sources

Patch Information

At the time of publication, no vendor patch has been referenced in the NVD entry for CVE-2025-11389. Refer to the Tenda official website for firmware updates and security advisories. If the device is end-of-life or no fix becomes available, plan migration to a supported router platform.

Workarounds

• Place the router behind a network segment that blocks untrusted hosts from reaching TCP/80 and TCP/443 on the management interface
• Use a host-based ACL on upstream switches to permit management traffic only from administrative workstations
• Disable the Auto QoS feature where the configuration path allows it, reducing exposure of the vulnerable handler
• Replace affected hardware with a router that receives current security maintenance if no firmware fix is released

# Example: restrict access to the Tenda AC15 management interface using iptables on an upstream Linux gateway
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80 -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 443 -j DROP