CVE-2025-70753: Tenda AX-1806 Stack Overflow DoS Flaw

CVE-2025-70753 Overview

A stack overflow vulnerability has been discovered in the Tenda AX-1806 wireless router firmware version 1.0.0.1. The vulnerability exists in the security_5g parameter handling within the sub_4CA50 function. This flaw allows remote attackers to cause a Denial of Service (DoS) condition by sending specially crafted requests to the affected device.

Critical Impact

Attackers can remotely crash the Tenda AX-1806 router, disrupting network connectivity for all connected devices and potentially requiring manual device restart.

Affected Products

• Tenda AX-1806 v1.0.0.1

Discovery Timeline

• January 13, 2026 - CVE-2025-70753 published to NVD
• January 13, 2026 - Last updated in NVD database

Technical Details for CVE-2025-70753

Vulnerability Analysis

This vulnerability is a classic stack overflow condition affecting embedded firmware on consumer networking equipment. The sub_4CA50 function in the Tenda AX-1806 firmware fails to properly validate the length of input received through the security_5g parameter. When processing requests containing this parameter, the function copies user-supplied data to a fixed-size stack buffer without adequate bounds checking.

The vulnerability is particularly concerning for IoT devices like routers, as they are often exposed to network traffic from both internal and external sources. Successful exploitation results in a denial of service condition, rendering the router unresponsive and disrupting network connectivity for all devices relying on it.

Root Cause

The root cause of this vulnerability lies in improper input validation within the sub_4CA50 function. The firmware does not implement sufficient boundary checks when handling the security_5g parameter, allowing an attacker to provide input that exceeds the allocated stack buffer size. This causes stack memory corruption, leading to application crash and denial of service.

Embedded device firmware often operates with limited memory protection mechanisms compared to modern operating systems, making stack overflow vulnerabilities particularly impactful in IoT environments.

Attack Vector

The attack vector involves sending a crafted HTTP request to the vulnerable Tenda AX-1806 router. The attacker constructs a request with an oversized security_5g parameter value that triggers the stack overflow condition in the sub_4CA50 function.

The vulnerability can be exploited by any attacker with network access to the router's management interface. This could include attackers on the local network or, if the management interface is exposed to the internet, remote attackers. The attack requires no authentication, making it accessible to any party capable of sending network requests to the device.

For detailed technical analysis and proof-of-concept information, refer to the GitHub Vulnerability Report.

Detection Methods for CVE-2025-70753

Indicators of Compromise

• Unexpected router reboots or crashes without administrative action
• Loss of network connectivity coinciding with malformed request traffic to the router
• Abnormally large HTTP request payloads targeting the router's management interface
• Router becoming unresponsive to ping or management console access

Detection Strategies

• Monitor network traffic for HTTP requests with unusually large security_5g parameter values destined for Tenda devices
• Implement intrusion detection rules to flag oversized parameter values in router management traffic
• Deploy network segmentation to isolate IoT devices and enable granular traffic monitoring
• Use SentinelOne Singularity for network anomaly detection to identify exploitation attempts

Monitoring Recommendations

• Enable logging on network firewalls to capture traffic directed at router management interfaces
• Configure alerts for repeated connection failures or timeouts to Tenda AX-1806 devices
• Monitor router uptime metrics to detect unexpected service disruptions
• Implement periodic availability checks for critical network infrastructure devices

How to Mitigate CVE-2025-70753

Immediate Actions Required

• Restrict access to the Tenda AX-1806 management interface to trusted IP addresses only
• Disable remote management features if not required for operations
• Implement network segmentation to limit exposure of vulnerable devices
• Monitor for firmware updates from Tenda and apply patches as soon as they become available
• Consider replacing end-of-support devices with actively maintained alternatives

Patch Information

No official patch information is available from the vendor at this time. Users should monitor the Tenda website and the GitHub Vulnerability Report for updates regarding remediation. Until a patch is released, implementing the workarounds and network controls listed below is essential to reducing risk.

Workarounds

• Configure firewall rules to block external access to the router management interface
• Limit management interface access to specific trusted internal IP addresses using access control lists
• Place the Tenda AX-1806 behind a more secure gateway device with active threat monitoring
• Disable any unnecessary services or features that expose additional attack surface on the device

# Example: Block external access to router management (on upstream firewall)
# Adjust IP addresses to match your environment
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP