CVE-2025-13446 Overview
CVE-2025-13446 is a stack-based buffer overflow vulnerability in the Tenda AC21 router running firmware version 16.03.08.16. The flaw resides in the /goform/SetSysTimeCfg endpoint, where the timeZone and time parameters are not properly bounds-checked before being copied into a fixed-size stack buffer. Remote attackers with low privileges can exploit the issue over the network to corrupt memory and potentially execute arbitrary code on the device. The vulnerability has been publicly disclosed, increasing the likelihood of opportunistic exploitation against exposed devices.
Critical Impact
Remote attackers can corrupt stack memory on Tenda AC21 routers through the SetSysTimeCfg handler, enabling potential code execution and full device compromise.
Affected Products
- Tenda AC21 router (hardware)
- Tenda AC21 firmware version 16.03.08.16
- Web management interface endpoint /goform/SetSysTimeCfg
Discovery Timeline
- 2025-11-20 - CVE-2025-13446 published to the National Vulnerability Database (NVD)
- 2025-11-21 - Last updated in NVD database
Technical Details for CVE-2025-13446
Vulnerability Analysis
The vulnerability is a stack-based buffer overflow [CWE-119] in the HTTP handler that processes system time configuration requests on the Tenda AC21 router. The /goform/SetSysTimeCfg endpoint accepts the timeZone and time parameters from authenticated web requests. The handler copies these attacker-controlled strings into stack-allocated buffers without validating their length.
When an attacker submits an oversized value for either parameter, the copy operation writes past the end of the destination buffer. This corrupts adjacent stack data, including saved return addresses and frame pointers. Embedded MIPS-based routers like the AC21 typically lack modern exploit mitigations such as stack canaries and full ASLR, which makes return-address hijacking practical.
Root Cause
The root cause is missing input length validation on the timeZone and time query parameters before they reach a string copy routine. The fixed-size stack buffer cannot accommodate arbitrary input lengths, and no bounds check exists between request parsing and the copy operation.
Attack Vector
Exploitation occurs over the network against the router's HTTP management interface. An attacker authenticated to the web UI sends a crafted POST request to /goform/SetSysTimeCfg containing an overlong timeZone or time value. Successful exploitation grants control over the program counter, enabling arbitrary code execution in the context of the web server process, which typically runs as root on Tenda devices.
No verified public exploit code is available at the time of writing. Technical details have been documented in the referenced GitHub vulnerability writeup and VulDB entry 333018.
Detection Methods for CVE-2025-13446
Indicators of Compromise
- HTTP POST requests to /goform/SetSysTimeCfg containing unusually long timeZone or time parameter values
- Unexpected reboots or web service crashes on Tenda AC21 routers following inbound HTTP traffic
- Outbound connections from the router to unfamiliar hosts, indicating possible post-exploitation activity
- DNS or configuration changes on the router that were not made by administrators
Detection Strategies
- Inspect web access logs or upstream proxy logs for requests to /goform/SetSysTimeCfg with parameter values exceeding typical lengths (timezone strings are normally under 32 bytes)
- Deploy network intrusion detection signatures that flag oversized POST bodies targeting Tenda /goform/ endpoints
- Monitor router uptime and process restart patterns through SNMP or syslog forwarding
Monitoring Recommendations
- Forward router syslog to a centralized logging platform and alert on repeated web service crashes
- Restrict access to the router management interface to a dedicated administrative VLAN and monitor for policy violations
- Track firmware versions across managed Tenda devices to identify hosts still running 16.03.08.16
How to Mitigate CVE-2025-13446
Immediate Actions Required
- Disable remote management on the WAN interface of all Tenda AC21 routers immediately
- Restrict LAN-side access to the web management interface to trusted administrative hosts only
- Rotate the router administrator password to limit the pool of accounts that could reach the vulnerable endpoint
- Audit deployed Tenda devices for firmware version 16.03.08.16 and prioritize them for remediation
Patch Information
No vendor patch has been listed in the available references at the time of publication. Administrators should monitor the Tenda official website for firmware updates addressing CVE-2025-13446. If a fixed firmware release becomes available, schedule deployment as soon as feasible.
Workarounds
- Block external access to TCP ports 80 and 443 on the router's WAN interface using upstream firewall rules
- Place the router behind a segmented network and disallow untrusted clients from reaching the management UI
- Replace end-of-support or unpatched Tenda AC21 devices with hardware that receives active security updates if no fix is released
# Example upstream firewall rule to block WAN-side access to the router web UI
iptables -A FORWARD -i wan0 -p tcp -m multiport --dports 80,443 -d <router_ip> -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
