CVE-2025-70744: Tenda AX1806 Firmware DoS Vulnerability

CVE-2025-70744 Overview

A stack overflow vulnerability has been discovered in the Tenda AX-1806 wireless router firmware version 1.0.0.1. The vulnerability exists in the cloneType parameter handling within the sub_65B5C function, where insufficient bounds checking allows attackers to trigger a stack-based buffer overflow condition. This vulnerability enables remote attackers to cause a Denial of Service (DoS) by sending specially crafted HTTP requests to the affected device.

Critical Impact

Remote attackers can crash the Tenda AX-1806 router without authentication, disrupting network connectivity for all connected devices and potentially requiring manual intervention to restore service.

Affected Products

• Tenda AX-1806 Firmware version 1.0.0.1
• Tenda AX-1806 Hardware devices running vulnerable firmware

Discovery Timeline

• 2026-01-15 - CVE-2025-70744 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2025-70744

Vulnerability Analysis

This vulnerability is classified as CWE-121 (Stack-based Buffer Overflow), a memory corruption issue that occurs when data written to a buffer on the stack exceeds its allocated size. In the case of the Tenda AX-1806, the sub_65B5C function fails to properly validate the length of user-supplied input in the cloneType parameter before copying it to a fixed-size stack buffer.

The network-accessible nature of this vulnerability means that attackers can exploit it remotely without requiring any prior authentication or user interaction. When triggered, the overflow corrupts adjacent stack memory, leading to abnormal program termination and a complete denial of service condition.

Root Cause

The root cause of this vulnerability lies in improper input validation within the sub_65B5C function. The function processes the cloneType parameter from incoming HTTP requests but fails to enforce appropriate length restrictions before performing memory copy operations. This allows an attacker to supply an oversized value that exceeds the stack buffer boundaries, resulting in stack memory corruption.

The absence of stack canaries or other overflow protection mechanisms in the firmware binary allows the corruption to proceed undetected until the function attempts to return, at which point the corrupted return address or saved registers cause the device to crash.

Attack Vector

The attack vector is network-based, requiring the attacker to have network access to the router's management interface. The exploitation process involves:

1. Target Identification: Attacker identifies a Tenda AX-1806 router running firmware version 1.0.0.1 on the network
2. Request Construction: A malicious HTTP request is crafted with an oversized cloneType parameter value designed to overflow the stack buffer
3. Payload Delivery: The crafted request is sent to the router's web management interface
4. Overflow Trigger: The sub_65B5C function processes the malicious parameter, causing stack memory corruption
5. Denial of Service: The router crashes, interrupting network services for all connected clients

The vulnerability requires no authentication, making it particularly dangerous for devices exposed to untrusted networks. Technical details regarding the specific exploitation mechanics can be found in the GitHub Vulnerability Report.

Detection Methods for CVE-2025-70744

Indicators of Compromise

• Unexpected router reboots or unresponsiveness without apparent cause
• HTTP requests with abnormally long cloneType parameter values in router access logs
• Network connectivity disruptions affecting all devices connected to the router
• Repeated crash patterns in device memory logs (if accessible)

Detection Strategies

• Monitor network traffic for HTTP requests to the router management interface containing oversized parameter values
• Implement network intrusion detection rules to flag requests with cloneType parameters exceeding normal length thresholds
• Deploy SentinelOne Singularity for network anomaly detection to identify exploitation attempts targeting IoT devices
• Establish baseline traffic patterns to the router management interface and alert on deviations

Monitoring Recommendations

• Enable logging on any upstream firewall or network monitoring solution to capture traffic destined for the router's management ports
• Configure alerts for repeated connection attempts to the router management interface from untrusted sources
• Monitor router availability using automated health checks to detect DoS conditions promptly
• Review access control lists to ensure management interface access is restricted to trusted networks only

How to Mitigate CVE-2025-70744

Immediate Actions Required

• Restrict access to the Tenda AX-1806 management interface to trusted internal networks only
• Disable remote management features if not required for operations
• Implement firewall rules to block external access to the router's HTTP management port
• Monitor for firmware updates from Tenda that address this vulnerability

Patch Information

At the time of publication, no official patch has been released by Tenda to address CVE-2025-70744. Users should monitor the official Tenda support channels for firmware updates and apply them immediately upon availability. For technical details about the vulnerability, refer to the GitHub Vulnerability Report.

Workarounds

• Configure firewall rules to restrict management interface access to specific trusted IP addresses only
• Disable the web management interface entirely if remote administration is not required
• Place the router behind a network segment with strict access controls
• Consider deploying an alternative router or access point if continuous availability is critical

# Example firewall rule to restrict management interface access
# (Apply on upstream firewall or router if supported)
# Restrict HTTP management access to trusted admin subnet only
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP