CVE-2025-11523: Tenda AC7 Firmware RCE Vulnerability

CVE-2025-11523 Overview

CVE-2025-11523 is a command injection vulnerability in the Tenda AC7 router running firmware version 15.03.06.44. The flaw exists in the /goform/AdvSetLanip endpoint, where the lanIp parameter is passed to a system command without proper sanitization. An authenticated remote attacker can manipulate this parameter to execute arbitrary operating system commands on the device. Public disclosure references indicate that exploit details are available, increasing the risk of opportunistic attacks against exposed routers. The vulnerability is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and [CWE-77] (Command Injection).

Critical Impact
Successful exploitation allows command execution on the router, enabling traffic interception, persistent backdoors, or pivoting into the internal network.

Affected Products

Tenda AC7 router (hardware version 1.0)
Tenda AC7 firmware version 15.03.06.44
Configurations exposing the web management interface to untrusted networks

Discovery Timeline

2025-10-09 - CVE-2025-11523 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-11523

Vulnerability Analysis

The vulnerability resides in the LAN configuration handler exposed at /goform/AdvSetLanip on the Tenda AC7 router's web management interface. The handler accepts a lanIp parameter that is intended to specify a new LAN IP address. Instead of validating the input against an IP address format, the firmware concatenates the value into a shell command executed by the underlying Linux system. This pattern allows an attacker to inject shell metacharacters such as semicolons, backticks, or pipes to chain additional commands. Because the router's web services typically run with elevated privileges, injected commands execute with the same level of access. Public documentation of the issue is available in the GitHub IoT Vulnerability Documentation and via the VulDB #327661 entry.

Root Cause

The root cause is missing input validation and sanitization on the lanIp parameter inside the AdvSetLanip handler. The firmware trusts user-supplied input and forwards it directly to a system() style call, which is the canonical pattern behind [CWE-77]. No allowlist, regular expression check, or escaping routine prevents shell metacharacters from being interpreted by the command shell.

Attack Vector

The attack is delivered over the network through an HTTP POST request to the router's management interface. The attacker must have access to the web interface and minimal privileges to submit configuration changes. Where the management interface is exposed to the WAN, the attack can be conducted from the public internet. The payload typically appends shell operators to a valid-looking IP value, causing the appended commands to execute on the device's BusyBox shell. See the GitHub proof-of-concept writeup for parameter-level details.

Detection Methods for CVE-2025-11523

Indicators of Compromise

HTTP POST requests to /goform/AdvSetLanip containing shell metacharacters (;, &&, |, backticks) in the lanIp parameter
Unexpected outbound connections originating from the router to attacker-controlled infrastructure
New or modified processes on the router, including reverse shells or telnetd/dropbear instances bound to unusual ports
DNS resolver or firewall rule changes on the router that were not made by an administrator

Detection Strategies

Inspect web server and management interface logs for requests to /goform/AdvSetLanip with non-IP characters in the lanIp field
Deploy network intrusion detection signatures that flag HTTP requests containing shell injection patterns targeted at Tenda goform endpoints
Baseline router behavior and alert on deviations such as new listening ports, modified iptables rules, or unexpected configuration changes

Monitoring Recommendations

Forward router syslog and management interface logs to a centralized logging platform for retention and correlation
Monitor for administrative logins from unexpected source IP addresses, particularly from the WAN side
Track DHCP and DNS configuration changes on the router and alert on unauthorized modifications

How to Mitigate CVE-2025-11523

Immediate Actions Required

Disable remote management on the WAN interface and restrict the web management interface to trusted LAN segments
Change the default and current administrator credentials to strong, unique values to limit access to the vulnerable endpoint
Place affected Tenda AC7 routers behind a perimeter firewall that blocks inbound HTTP/HTTPS requests to the device
Audit router configuration for unauthorized changes such as DNS overrides, port forwards, or new admin users

Patch Information

At the time of NVD publication, no vendor patch is referenced for the Tenda AC7 firmware version 15.03.06.44. Check the Tenda Official Website for firmware updates addressing the AdvSetLanip handler. If no fixed firmware is available, consider replacing the device with one that receives active security maintenance.

Workarounds

Segment the router's management VLAN and apply ACLs that permit access only from designated administrative hosts
Disable any UPnP, remote management, or cloud-management features that expose configuration endpoints
Factory-reset and reconfigure routers suspected of compromise, then verify firmware integrity before returning them to service

bash

# Example: restrict access to the router management interface using an upstream firewall
# Replace 192.0.2.10 with the trusted admin host and 192.168.0.1 with the router IP
iptables -A FORWARD -s 192.0.2.10 -d 192.168.0.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.168.0.1 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.168.0.1 -p tcp --dport 443 -j DROP