CVE-2025-29384: Tenda AC9 Firmware RCE Vulnerability

CVE-2025-29384 Overview

CVE-2025-29384 is a stack overflow vulnerability affecting the Tenda AC9 wireless router. The vulnerability exists in the wanMTU parameter handling within the /goform/AdvSetMacMtuWan endpoint. When a specially crafted request is sent to this endpoint, an attacker can trigger a stack-based buffer overflow condition that leads to remote arbitrary code execution without any authentication requirements.

This firmware vulnerability represents a significant risk to network infrastructure as it allows unauthenticated attackers to gain complete control over the affected router device from a network-accessible position.

Critical Impact

Unauthenticated remote attackers can achieve arbitrary code execution on vulnerable Tenda AC9 routers, potentially compromising the entire network infrastructure and enabling further attacks on connected devices.

Affected Products

• Tenda AC9 Hardware Version 1.0
• Tenda AC9 Firmware Version 15.03.05.14_multi
• Tenda AC9 Firmware (tenda ac9_firmware)

Discovery Timeline

• 2025-03-14 - CVE CVE-2025-29384 published to NVD
• 2025-03-19 - Last updated in NVD database

Technical Details for CVE-2025-29384

Vulnerability Analysis

This vulnerability is classified as CWE-787 (Out-of-bounds Write), which describes a memory corruption issue where the software writes data past the end of an allocated buffer. In the context of the Tenda AC9 router, the firmware fails to properly validate the length of the wanMTU parameter before copying it to a stack-based buffer. When an attacker supplies an oversized value, the excess data overwrites adjacent memory on the stack, including the saved return address.

The attack can be executed remotely over the network without requiring any authentication or user interaction. Successful exploitation grants the attacker the same privileges as the web server process running on the device, which typically operates with root-level access on embedded devices like consumer routers.

Root Cause

The root cause of CVE-2025-29384 lies in the absence of proper bounds checking when the firmware processes the wanMTU parameter received through HTTP requests to the /goform/AdvSetMacMtuWan endpoint. The vulnerable code copies user-supplied input directly into a fixed-size stack buffer without verifying that the input length does not exceed the buffer's capacity.

This is a common pattern in embedded firmware development where memory-unsafe functions like strcpy() or sprintf() are used without corresponding length validation, allowing attackers to overflow stack buffers and hijack program execution flow.

Attack Vector

The attack is conducted over the network by sending a malicious HTTP POST request to the router's web management interface at the /goform/AdvSetMacMtuWan endpoint. The attacker crafts a request containing an excessively long wanMTU parameter value designed to overflow the stack buffer and overwrite the return address with a controlled value.

The vulnerability does not require any prior authentication, meaning any attacker with network access to the router's web interface can attempt exploitation. Due to the nature of stack overflow attacks on embedded systems with potentially limited address space layout randomization (ASLR) and stack canary protections, exploitation reliability may be high.

For technical details and proof-of-concept information, refer to the GitHub PoC Repository documenting this vulnerability.

Detection Methods for CVE-2025-29384

Indicators of Compromise

• Unexpected HTTP POST requests to /goform/AdvSetMacMtuWan with abnormally large wanMTU parameter values
• Router crashes, reboots, or unresponsive behavior following web interface access attempts
• Unexpected outbound connections from the router to external IP addresses
• Modified router configuration or firmware settings without administrator action

Detection Strategies

• Deploy network intrusion detection rules to monitor for HTTP requests to /goform/AdvSetMacMtuWan containing oversized parameter values
• Implement web application firewall rules to block POST requests with excessively long parameter values to Tenda router management interfaces
• Monitor router device logs for signs of memory corruption or unexpected service restarts
• Use network traffic analysis to identify anomalous patterns from router devices

Monitoring Recommendations

• Enable logging on network firewalls to track access attempts to router management interfaces from untrusted networks
• Implement network segmentation to restrict access to router administration interfaces to authorized management VLANs
• Deploy endpoint detection and response solutions on network segments to identify post-exploitation activity
• Regularly audit router firmware versions against known vulnerability databases

How to Mitigate CVE-2025-29384

Immediate Actions Required

• Restrict network access to the Tenda AC9 router's web management interface to trusted IP addresses only
• Disable remote management features if not absolutely required for operations
• Place the router behind a firewall that can filter malicious requests to the vulnerable endpoint
• Monitor network traffic for exploitation attempts targeting /goform/AdvSetMacMtuWan
• Consider replacing vulnerable devices with alternatives if no patch is available from the vendor

Patch Information

At the time of this publication, no official patch information is available from Tenda for CVE-2025-29384. Organizations should monitor Tenda's official support channels for firmware updates addressing this vulnerability. Until a patch is released, implementing network-based mitigations and access controls is strongly recommended.

Workarounds

• Configure firewall rules to block external access to the router's web management interface (typically port 80/443)
• Use VLANs to isolate router management interfaces from general network traffic
• Disable the web-based management interface entirely if command-line management is sufficient
• Implement network-level intrusion prevention to detect and block stack overflow exploitation patterns

# Example: Block external access to router management on Linux gateway
iptables -A FORWARD -d <router_ip> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <router_ip> -p tcp --dport 443 -j DROP

# Allow management only from trusted admin network
iptables -I FORWARD -s <admin_network>/24 -d <router_ip> -p tcp --dport 80 -j ACCEPT