CVE-2025-70747: Tenda AX1806 Firmware DoS Vulnerability

CVE-2025-70747 Overview

A stack overflow vulnerability has been identified in the Tenda AX-1806 wireless router firmware version 1.0.0.1. The vulnerability exists within the serviceName parameter of the sub_65A28 function, where improper boundary checking allows attackers to trigger a stack-based buffer overflow condition. This vulnerability can be exploited remotely via a specially crafted HTTP request, resulting in a Denial of Service (DoS) condition that renders the affected device unresponsive.

Critical Impact

Remote attackers can crash Tenda AX-1806 routers without authentication by sending malformed requests to the vulnerable sub_65A28 function, causing network service disruption.

Affected Products

• Tenda AX-1806 Firmware version 1.0.0.1
• Tenda AX-1806 Hardware Device

Discovery Timeline

• January 14, 2026 - CVE-2025-70747 published to NVD
• January 20, 2026 - Last updated in NVD database

Technical Details for CVE-2025-70747

Vulnerability Analysis

This vulnerability is classified as CWE-121 (Stack-based Buffer Overflow), a memory corruption flaw that occurs when data written to a stack buffer exceeds its allocated size. In the case of CVE-2025-70747, the sub_65A28 function in the Tenda AX-1806 firmware fails to properly validate the length of the serviceName parameter before copying it to a fixed-size stack buffer.

The vulnerability can be exploited over the network without requiring authentication or user interaction. When an attacker sends a crafted request containing an oversized serviceName value, the function writes beyond the stack buffer's boundaries, corrupting adjacent stack memory including return addresses and saved registers. This corruption leads to application crashes and device unavailability.

The impact is limited to availability; the vulnerability does not allow for data exfiltration or arbitrary code execution based on the current analysis. However, DoS attacks against network infrastructure devices like routers can have significant downstream effects on connected clients and network services.

Root Cause

The root cause of CVE-2025-70747 is insufficient input validation in the sub_65A28 function when processing the serviceName parameter. The firmware does not verify that user-supplied input fits within the allocated stack buffer before performing memory copy operations. This missing bounds check allows attackers to supply arbitrarily long input strings that overflow the buffer and corrupt stack memory, leading to abnormal program termination.

Attack Vector

The attack vector for this vulnerability is network-based, requiring an attacker to send a specially crafted HTTP request to the Tenda AX-1806 device. The attack does not require any authentication credentials or prior access to the device. An attacker on the same network segment, or potentially from the internet if the device's management interface is exposed, can trigger the vulnerability by submitting a malformed serviceName parameter value that exceeds expected length limits. The exploitation process involves:

1. Identifying a Tenda AX-1806 device running vulnerable firmware version 1.0.0.1
2. Crafting an HTTP request with an oversized serviceName parameter targeting the vulnerable function
3. Sending the request to trigger the stack overflow condition
4. The device crashes and becomes unresponsive, denying service to legitimate users

For technical details and proof-of-concept information, refer to the GitHub PoC for Tenda AX-1806.

Detection Methods for CVE-2025-70747

Indicators of Compromise

• Unexpected router reboots or crashes without apparent cause
• Network connectivity interruptions affecting devices behind the Tenda AX-1806
• Log entries showing malformed HTTP requests with abnormally long serviceName parameters
• Repeated crash loops requiring manual device intervention

Detection Strategies

• Monitor network traffic for HTTP requests to Tenda AX-1806 devices containing unusually long parameter values in the serviceName field
• Implement intrusion detection signatures to identify buffer overflow attack patterns targeting Tenda devices
• Deploy network-based anomaly detection to flag requests exceeding normal parameter length thresholds
• Review device logs for crash events correlated with incoming HTTP traffic

Monitoring Recommendations

• Enable comprehensive logging on network perimeter devices to capture traffic destined for IoT/router management interfaces
• Configure alerting for Tenda AX-1806 device availability using network monitoring tools
• Segment IoT and network infrastructure devices to limit exposure and simplify traffic analysis
• Regularly review firmware versions across all Tenda devices in the environment

How to Mitigate CVE-2025-70747

Immediate Actions Required

• Restrict network access to the Tenda AX-1806 management interface to trusted IP addresses only
• Disable remote management if not required for operations
• Place affected devices behind a firewall with strict ingress filtering
• Monitor for vendor security advisories and firmware updates

Patch Information

At the time of this publication, no official patch from Tenda has been documented in the CVE data. Organizations should monitor Tenda's official support channels for firmware updates addressing this vulnerability. The affected firmware version is 1.0.0.1 of the Tenda AX-1806.

Workarounds

• Implement network-level access controls to restrict who can reach the device's web interface
• Use a firewall or ACL to block external access to the router's management ports
• Consider deploying an upstream intrusion prevention system (IPS) to filter malicious requests
• If feasible, replace vulnerable devices with alternatives that have active security support

# Example: Restrict management access via iptables on an upstream Linux firewall
# Allow only trusted admin subnet to access Tenda device management interface
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 80 -s 192.168.100.0/24 -j ACCEPT
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 80 -j DROP