CVE-2025-5849: Tenda AC15 Buffer Overflow Vulnerability

CVE-2025-5849 Overview

CVE-2025-5849 is a stack-based buffer overflow vulnerability in the Tenda AC15 router running firmware version 15.03.05.19_multi. The flaw resides in the formSetSafeWanWebMan function reachable via the /goform/SetRemoteWebCfg endpoint of the HTTP POST request handler. Attackers can exploit the issue by manipulating the remoteIp argument to overflow a fixed-size stack buffer. The vulnerability is remotely exploitable over the network and the exploit details have been publicly disclosed, increasing the likelihood of weaponization against exposed devices. The weakness is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact
Remote attackers with low privileges can trigger memory corruption in the Tenda AC15 web management interface, enabling potential arbitrary code execution and full compromise of the router.

Affected Products

Tenda AC15 router (hardware version 1.0)
Tenda AC15 firmware 15.03.05.19_multi
Deployments exposing the /goform/SetRemoteWebCfg interface to untrusted networks

Discovery Timeline

2025-06-08 - CVE-2025-5849 published to NVD
2025-06-09 - Last updated in NVD database

Technical Details for CVE-2025-5849

Vulnerability Analysis

The Tenda AC15 web management daemon exposes the formSetSafeWanWebMan handler through the /goform/SetRemoteWebCfg URI. This handler processes remote web management configuration submitted via HTTP POST requests. The remoteIp POST parameter is copied into a fixed-size stack buffer without sufficient bounds checking. Supplying an oversized value overruns the buffer, corrupts adjacent stack memory, and can overwrite the saved return address. Successful exploitation can hijack control flow within the httpd process running on the router, which typically executes with elevated privileges on embedded Linux MIPS firmware.

Root Cause

The root cause is unsafe handling of attacker-controlled string data inside formSetSafeWanWebMan. The function relies on length-unaware string copy semantics when transferring the remoteIp value from the HTTP request into a local stack buffer. Without length validation against the destination size, any input longer than the allocated buffer corrupts saved registers and the return address on the stack.

Attack Vector

An attacker reaches the vulnerable handler by sending a crafted HTTP POST request to /goform/SetRemoteWebCfg on the router's management interface. The CVSS vector indicates network reachability with low attack complexity and low privileges required. Devices with remote web management enabled on the WAN are exposed to internet-based attackers. On the LAN, any authenticated low-privileged user on the management interface can reach the endpoint. The publicly disclosed proof-of-concept describes overflowing the remoteIp parameter to trigger the crash and potentially achieve code execution.

No verified exploit code is included. See the public technical write-up referenced in the
[Notion Resource Overview](https://candle-throne-f75.notion.site/Tenda-AC15-formSetSafeWanWebMan-20adf0aa1185806daab3ebe0036266cb)
and [VulDB #311595](https://vuldb.com/?id.311595) for further details.

Detection Methods for CVE-2025-5849

Indicators of Compromise

HTTP POST requests to /goform/SetRemoteWebCfg containing abnormally long remoteIp values, typically exceeding 64 to 256 bytes.
Unexpected reboots, httpd crashes, or watchdog resets on Tenda AC15 devices following inbound web management traffic.
Outbound connections from the router to unfamiliar IP addresses after web management requests, which may indicate post-exploitation activity.

Detection Strategies

Inspect web application firewall and IDS logs for POST requests targeting /goform/SetRemoteWebCfg with non-IP-formatted remoteIp payloads.
Create Snort or Suricata signatures matching oversized remoteIp parameters in HTTP request bodies destined for Tenda management ports.
Correlate router syslog entries with NetFlow records to identify reboots that follow inbound HTTP traffic to the management interface.

Monitoring Recommendations

Forward router syslog and HTTP access logs to a centralized analytics platform for anomaly detection on management endpoints.
Baseline normal traffic to /goform/ URIs and alert on parameter length deviations or non-administrator source IPs.
Monitor for any exposure of the router web interface on WAN-facing IP addresses using external attack surface scans.

How to Mitigate CVE-2025-5849

Immediate Actions Required

Disable remote web management on the WAN interface of all Tenda AC15 devices until a vendor patch is applied.
Restrict access to the LAN-side management interface to a dedicated administrative VLAN or trusted host list.
Audit deployed firmware versions and identify any device running 15.03.05.19_multi for prioritized remediation.

Patch Information

As of the NVD publication date, Tenda has not released a security advisory or fixed firmware version referenced in the public CVE record. Consult the Tenda Official Website for firmware updates addressing formSetSafeWanWebMan. Replace end-of-life Tenda AC15 hardware if no patched firmware becomes available.

Workarounds

Place the router behind an upstream firewall that blocks inbound TCP traffic to the management HTTP port from untrusted networks.
Change default administrator credentials and enforce strong passwords to limit low-privileged access required for exploitation.
Segment IoT and infrastructure devices away from user networks to limit lateral movement if a router is compromised.

bash

# Example: block WAN access to the router HTTP management port using an upstream firewall
iptables -I FORWARD -p tcp -d <router_wan_ip> --dport 80 -j DROP
iptables -I FORWARD -p tcp -d <router_wan_ip> --dport 443 -j DROP