CVE-2025-70746: Tenda AX-1806 Stack Overflow DoS Vulnerability

CVE-2025-70746 Overview

A stack overflow vulnerability has been identified in the Tenda AX-1806 router firmware version 1.0.0.1. The vulnerability exists in the fromSetSysTime function, specifically within the handling of the timeZone parameter. This flaw allows remote attackers to cause a Denial of Service (DoS) condition by sending specially crafted requests to the affected device.

Critical Impact

Unauthenticated remote attackers can crash the Tenda AX-1806 router by exploiting the stack overflow in the timeZone parameter, causing complete loss of network connectivity for all connected devices.

Affected Products

• Tenda AX-1806 v1.0.0.1
• Tenda AX-1806 firmware with vulnerable fromSetSysTime function

Discovery Timeline

• 2026-01-16 - CVE-2025-70746 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2025-70746

Vulnerability Analysis

This vulnerability is classified as CWE-121 (Stack-based Buffer Overflow). The flaw resides in the fromSetSysTime function, which is responsible for handling system time configuration requests on the Tenda AX-1806 router. When processing the timeZone parameter, the function fails to properly validate the length of user-supplied input before copying it to a fixed-size stack buffer.

The vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can send a malicious HTTP request containing an oversized timeZone parameter value, which will overflow the stack buffer and corrupt adjacent memory. This memory corruption leads to a crash of the web management service or potentially the entire device, resulting in a denial of service condition.

Root Cause

The root cause of this vulnerability is improper input validation in the fromSetSysTime function. The function accepts user-controlled data for the timeZone parameter without implementing proper bounds checking. When the input exceeds the allocated buffer size on the stack, the excess data overwrites adjacent stack memory, including the function's return address and saved registers. This classic stack-based buffer overflow pattern is a common weakness in embedded device firmware where memory safety practices may be less rigorous.

Attack Vector

The attack vector is network-based, allowing remote exploitation without authentication. An attacker can craft a malicious HTTP request targeting the system time configuration endpoint with an excessively long timeZone parameter. The crafted request triggers the stack overflow, causing the device to crash or become unresponsive.

The attack can be performed by any network-accessible attacker on the same network segment as the router's management interface. If the management interface is exposed to the internet (which is not recommended), the attack surface extends to any remote attacker.

The vulnerability mechanism involves sending an HTTP request to the fromSetSysTime endpoint with a timeZone parameter value that exceeds the expected buffer size. The function copies this oversized input directly onto the stack without length validation, causing memory corruption and subsequent service crash. For detailed technical analysis, refer to the GitHub Vulnerability Analysis.

Detection Methods for CVE-2025-70746

Indicators of Compromise

• Unexpected router reboots or unresponsive web management interface
• Network connectivity loss for all connected devices without apparent cause
• Unusual HTTP requests to the system time configuration endpoint with abnormally long parameter values
• Crash logs indicating memory corruption in the web service process

Detection Strategies

• Monitor HTTP traffic to the router's management interface for requests with oversized timeZone parameters
• Implement network-based intrusion detection rules to identify buffer overflow attack patterns targeting Tenda devices
• Set up alerts for repeated router restarts or service interruptions that may indicate active exploitation attempts
• Use web application firewalls to filter requests with excessively long parameter values

Monitoring Recommendations

• Enable logging on the router management interface to capture all incoming configuration requests
• Monitor network availability metrics to detect sudden service disruptions
• Implement SNMP or other monitoring protocols to track device uptime and detect unexpected reboots
• Review router logs for error messages related to memory allocation failures or stack corruption

How to Mitigate CVE-2025-70746

Immediate Actions Required

• Restrict access to the router's web management interface to trusted IP addresses only
• Disable remote management access from the WAN interface if not absolutely necessary
• Place the router behind a firewall that can filter malicious requests
• Monitor the device for signs of exploitation while awaiting an official patch

Patch Information

At the time of publication, no official patch has been released by Tenda for this vulnerability. Users should monitor Tenda's official support channels for firmware updates addressing CVE-2025-70746. Additional technical details are available in the GitHub Vulnerability Analysis.

Workarounds

• Configure firewall rules to restrict management interface access to specific trusted IP addresses
• Disable the web management interface entirely if not required for daily operations
• Implement network segmentation to isolate the router's management interface from untrusted network segments
• Consider using an alternative router if the management interface cannot be adequately protected

# Example: Restrict management interface access using upstream firewall
# Block external access to router management port (typically 80/443)
iptables -A FORWARD -d [ROUTER_IP] -p tcp --dport 80 -j DROP
iptables -A FORWARD -d [ROUTER_IP] -p tcp --dport 443 -j DROP

# Allow only trusted management IPs
iptables -I FORWARD -s [TRUSTED_ADMIN_IP] -d [ROUTER_IP] -p tcp --dport 80 -j ACCEPT
iptables -I FORWARD -s [TRUSTED_ADMIN_IP] -d [ROUTER_IP] -p tcp --dport 443 -j ACCEPT