CVE-2025-3167 Overview
CVE-2025-3167 is a denial of service vulnerability affecting Tenda AC23 routers running firmware version 16.03.07.52. The flaw resides in the /goform/VerAPIMant endpoint of the API Interface component. Manipulation of the getuid argument triggers improper resource handling [CWE-404], causing the device to enter a denial of service condition. The vulnerability is exploitable remotely over the network and requires only low-level privileges. Public disclosure of exploitation details increases the likelihood of opportunistic attacks against exposed devices.
Critical Impact
Remote attackers with low privileges can disrupt availability of Tenda AC23 routers by sending crafted requests to the /goform/VerAPIMant endpoint, taking affected devices offline.
Affected Products
- Tenda AC23 router (hardware)
- Tenda AC23 firmware version 16.03.07.52
- Deployments exposing the router web management interface to untrusted networks
Discovery Timeline
- 2025-04-03 - CVE-2025-3167 published to NVD
- 2025-04-08 - Last updated in NVD database
Technical Details for CVE-2025-3167
Vulnerability Analysis
The vulnerability affects the API Interface handler in the Tenda AC23 firmware. Processing of requests to /goform/VerAPIMant does not adequately manage resources when the getuid argument is manipulated. This improper release of allocated resources [CWE-404] results in a denial of service condition. The router becomes unresponsive to legitimate management traffic and may require a reboot to restore functionality.
The attack is remotely initiated and does not require user interaction. Exploitation only requires network reachability to the affected endpoint and low-privilege authentication context. Because consumer-grade routers like the AC23 are frequently deployed with management interfaces accessible from the local network, attackers gaining a foothold on any LAN-connected device can trigger the condition.
Root Cause
The root cause is improper resource handling within the VerAPIMant API handler. When the getuid parameter is supplied with attacker-controlled input, the firmware fails to release or correctly manage allocated resources, leading to service disruption on the device.
Attack Vector
An attacker sends a crafted HTTP request to the /goform/VerAPIMant endpoint with a manipulated getuid argument. The malformed request causes the routing daemon to consume resources improperly and stop responding. No file upload, authentication bypass, or memory corruption primitive is required. Refer to the GitHub CVE Documentation and VulDB Vulnerability Details for additional technical context.
Detection Methods for CVE-2025-3167
Indicators of Compromise
- HTTP requests targeting the /goform/VerAPIMant URI on Tenda AC23 routers
- Unexpected reboots, service restarts, or loss of management plane responsiveness on the router
- Repeated requests containing manipulated getuid parameter values from the same source
Detection Strategies
- Inspect web server and router logs for access patterns to /goform/VerAPIMant from non-administrative hosts
- Deploy network IDS signatures matching crafted requests to the AC23 management API
- Correlate router availability monitoring alerts with concurrent inbound traffic to the management interface
Monitoring Recommendations
- Monitor router uptime and ICMP/SNMP responsiveness from a dedicated network management platform
- Alert on any access to /goform/ endpoints originating from untrusted VLANs or guest networks
- Track firmware version inventory to identify devices still running 16.03.07.52
How to Mitigate CVE-2025-3167
Immediate Actions Required
- Restrict access to the router web management interface to trusted administrative hosts only
- Disable remote (WAN-side) management on all Tenda AC23 devices
- Segment the router management plane from general user and IoT networks
- Audit firmware inventory and identify all devices running 16.03.07.52
Patch Information
No vendor patch is referenced in the published advisory at the time of NVD publication. Administrators should monitor the Tenda Official Website for firmware updates addressing CVE-2025-3167 and apply them once available.
Workarounds
- Place the router management interface behind a firewall ACL that only permits trusted source addresses
- Disable any unused API or remote administration features on the device
- Replace end-of-support consumer routers with vendor-supported hardware where feasible
- Monitor inbound traffic to /goform/VerAPIMant and rate-limit or block anomalous sources at an upstream firewall
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
