CVE-2025-45428: Remote Arbitrary Code Execution Vulnerability in Tenda AC9 v1.0 Firmware

Overview

The Common Vulnerabilities and Exposures (CVE) system has recently identified a critical vulnerability, CVE-2025-45428, found in Tenda AC9 v1.0 with firmware V15.03.05.14_multi. This vulnerability could potentially allow a remote attacker to execute arbitrary code on the affected system, leading to a full-scale compromise of the system and potential data leakage. As Tenda AC9 routers are widely used, this vulnerability could pose a significant risk to countless networks and systems worldwide, making the understanding and mitigation of this vulnerability crucial for maintaining cybersecurity standards.

Vulnerability Summary

CVE ID: CVE-2025-45428
Severity: Critical (CVSS score 9.8)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise and potential data leakage

Affected Products

Product | Affected Versions

Tenda AC9 v1.0 | Firmware V15.03.05.14_multi

How the Exploit Works

The exploit takes advantage of a stack overflow vulnerability in the rebootTime parameter of the /goform/SetSysAutoRebbotCfg endpoint in the Tenda AC9 firmware. A remote attacker can send a specially crafted request to this endpoint, causing the stack overflow, which in turn allows the execution of arbitrary code. The attacker does not need any special privileges to exploit this vulnerability, and no user interaction is required, which makes this vulnerability particularly dangerous.

Conceptual Example Code

Here is a conceptual example of how a malicious HTTP request exploiting this vulnerability might look:

POST /goform/SetSysAutoRebbotCfg HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "rebootTime": "[malicious_payload]" }

In the above example, “[malicious_payload]” represents a string of code designed to cause a stack overflow and execute arbitrary code on the system.

Recommended Mitigation

Users of the affected Tenda AC9 firmware are strongly advised to apply the vendor patch as soon as it becomes available. In the meantime, utilizing a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as a temporary mitigation for this vulnerability. Regularly updating systems and software, and monitoring network traffic for any suspicious activity are general best practices that can also help protect against such vulnerabilities.