CVE-2025-63457: Tenda AX1803 Firmware DoS Vulnerability

CVE-2025-63457 Overview

CVE-2025-63457 is a stack-based buffer overflow vulnerability in the Tenda AX-1803 wireless router running firmware version 1.0.0.1. The flaw resides in the sub_4F55C function and is triggered through the wanMTU parameter. A remote, unauthenticated attacker can send a crafted HTTP request to corrupt the stack and crash the device, producing a Denial of Service (DoS) condition. The vulnerability is tracked under [CWE-787] Out-of-Bounds Write and [CWE-121] Stack-Based Buffer Overflow.

Critical Impact

Unauthenticated remote attackers can crash the router via a malformed wanMTU value, disrupting network connectivity for all downstream clients.

Affected Products

• Tenda AX-1803 hardware
• Tenda AX-1803 firmware version 1.0.0.1
• Web management interface handling the wanMTU parameter

Discovery Timeline

• 2025-11-10 - CVE-2025-63457 published to NVD
• 2025-11-18 - Last updated in NVD database

Technical Details for CVE-2025-63457

Vulnerability Analysis

The Tenda AX-1803 web management interface processes WAN configuration parameters through the sub_4F55C function. This function reads the user-supplied wanMTU parameter from an HTTP request and copies it into a fixed-size stack buffer without enforcing length validation. When an attacker submits a wanMTU value longer than the destination buffer, the copy operation overruns the buffer and overwrites adjacent stack memory, including the saved return address. The router process then crashes when control flow returns through the corrupted stack frame, terminating the HTTP daemon and disrupting routing services.

Root Cause

The root cause is missing bounds checking on attacker-controlled input inside sub_4F55C. The function trusts the length of the wanMTU string from the HTTP request body and uses an unsafe string copy operation against a fixed-size stack buffer. This pattern, classified as [CWE-121], is recurrent across Tenda's MIPS-based residential router firmware.

Attack Vector

Exploitation requires network reachability to the router's management interface but does not require authentication or user interaction. An attacker sends a single HTTP POST request containing an oversized wanMTU parameter to the vulnerable endpoint. Successful exploitation causes the router process to crash, dropping all client traffic until the device reboots. Refer to the GitHub Vulnerability Report for technical reproduction details.

Detection Methods for CVE-2025-63457

Indicators of Compromise

• Unexpected reboots or crashes of the Tenda AX-1803 router during normal operation
• HTTP POST requests to the router management interface containing abnormally long wanMTU parameter values
• Loss of WAN connectivity coincident with inbound requests to the router's admin port
• Repeated short-duration outages of LAN clients tied to router restarts

Detection Strategies

• Inspect HTTP traffic destined for the router's management interface for wanMTU parameter lengths exceeding typical MTU string values (more than 5 characters)
• Correlate router uptime resets with inbound HTTP requests captured at the network perimeter
• Deploy network IDS signatures that flag oversized parameter values in form submissions to known Tenda admin endpoints

Monitoring Recommendations

• Log all administrative HTTP requests to the router and forward them to a centralized SIEM for parameter-length analysis
• Alert on repeated router reboot events within short time windows, which indicate sustained DoS attempts
• Monitor for unauthorized external access attempts to TCP/80 or TCP/443 on the router's WAN interface

How to Mitigate CVE-2025-63457

Immediate Actions Required

• Restrict access to the router's web management interface to trusted LAN hosts only and disable WAN-side administration
• Place the router behind a network segmentation boundary that filters untrusted HTTP traffic to the admin interface
• Audit the device for the affected firmware version 1.0.0.1 and prepare an upgrade plan once a vendor patch is published

Patch Information

No vendor advisory or patched firmware release has been published by Tenda at the time of NVD publication. Administrators should monitor the Tenda product support pages for firmware updates addressing the sub_4F55C stack overflow and apply them as soon as they are released.

Workarounds

• Disable remote management on the WAN interface to block unauthenticated external exploitation attempts
• Apply ACLs on upstream network devices to limit HTTP access to the router from approved management hosts only
• Replace the affected device with a supported model if no patch becomes available and exposure cannot be eliminated
• Place the router on an isolated VLAN to reduce blast radius if the device is crashed by an internal attacker