CVE-2025-4299: Tenda AC1206 Buffer Overflow Vulnerability

CVE-2025-4299 Overview

CVE-2025-4299 is a buffer overflow vulnerability in the Tenda AC1206 wireless router firmware up to version 15.03.06.23. The flaw resides in the setSchedWifi function handling requests to the /goform/openSchedWifi endpoint. Attackers can trigger the overflow remotely by sending crafted input over the network. The weakness is classified under CWE-119 and CWE-120, covering improper buffer boundary restrictions and classic buffer copy without size checking. Public proof-of-concept documentation has been disclosed, increasing exposure for unpatched devices.

Critical Impact
Remote attackers with low privileges can corrupt memory on Tenda AC1206 routers, potentially leading to arbitrary code execution or denial of service on the device.

Affected Products

Tenda AC1206 router (hardware)
Tenda AC1206 firmware versions up to and including 15.03.06.23
Deployments exposing the web management interface to untrusted networks

Discovery Timeline

2025-05-06 - CVE-2025-4299 published to NVD
2025-05-13 - Last updated in NVD database

Technical Details for CVE-2025-4299

Vulnerability Analysis

The vulnerability lives in the setSchedWifi handler that processes scheduled Wi-Fi configuration requests submitted to /goform/openSchedWifi. The handler copies user-controlled HTTP parameters into a fixed-size stack buffer without validating input length. Supplying an oversized value overruns the destination buffer and corrupts adjacent memory, including saved return addresses on the stack.

Successful exploitation impacts confidentiality, integrity, and availability of the router. An attacker can crash the httpd process, hijack control flow, or modify router configuration. Because the AC1206 runs on resource-constrained MIPS-based firmware with limited mitigations such as ASLR or stack canaries, exploitation primitives translate directly into device compromise.

Root Cause

The root cause is missing length validation in the setSchedWifi parser. The function trusts the size of attacker-supplied form fields and performs an unchecked copy into a stack buffer. This pattern is consistent with [CWE-120] buffer copy without checking size of input.

Attack Vector

The attack is delivered over the network against the router's HTTP management interface. The CVSS vector indicates low attack complexity and requires low-level privileges, meaning an authenticated session or exposed administrative interface enables exploitation. Devices reachable from the WAN or from compromised LAN clients are most exposed.

Public proof-of-concept material describing the request structure is hosted on GitHub PoC Documentation. Additional analysis is tracked on VulDB #307403.

No verified exploit code is reproduced here. Refer to the linked advisory for the technical request layout and parameter naming used to trigger the overflow.

Detection Methods for CVE-2025-4299

Indicators of Compromise

HTTP POST requests to /goform/openSchedWifi containing abnormally long parameter values
Repeated httpd crashes, reboots, or watchdog resets on AC1206 devices
Unexpected configuration changes to Wi-Fi scheduling or administrative settings
Outbound connections from the router to unknown command-and-control endpoints

Detection Strategies

Inspect HTTP traffic destined for the router management interface for oversized form fields targeting setSchedWifi parameters
Alert on unauthenticated or anomalous access to /goform/* endpoints from non-administrative source addresses
Correlate router crash events with preceding HTTP requests in network telemetry to identify exploitation attempts

Monitoring Recommendations

Forward router syslog and HTTP access logs to a centralized log platform for retention and analysis
Monitor for new device firmware versions and unexpected admin sessions on consumer-grade routers within the environment
Track lateral connections from routers to internal hosts that deviate from baseline behavior

How to Mitigate CVE-2025-4299

Immediate Actions Required

Restrict access to the router's HTTP management interface to trusted internal hosts only
Disable remote WAN administration if enabled on the device
Change default and weak administrator credentials to limit access by low-privilege attackers
Segment the router management VLAN from general user and IoT networks

Patch Information

At the time of NVD publication, no vendor patch is referenced in the advisory. Check the Tenda Official Website for firmware updates addressing the setSchedWifi buffer overflow. Affected organizations should consider replacing end-of-support consumer routers when no fixed firmware is available.

Workarounds

Block external access to /goform/openSchedWifi using an upstream firewall or ACL
Disable the scheduled Wi-Fi feature if it is not in use to reduce exposure of the vulnerable handler
Place the AC1206 behind a network segment that requires VPN authentication for management access
Replace the device with an actively supported router model if no patched firmware is released

bash

# Example upstream ACL to block external access to the vulnerable endpoint
iptables -I FORWARD -p tcp --dport 80 -d <router_ip> -m string \
  --algo bm --string "/goform/openSchedWifi" -j DROP
iptables -I FORWARD -p tcp --dport 80 -d <router_ip> ! -s <admin_subnet> -j DROP