CVE-2025-45429: Stack Overflow Vulnerability in Tenda ac9 v1.0 Router

Overview

CVE-2025-45429 is a severe and potentially damaging vulnerability found in the Tenda ac9 v1.0 router, specifically in the firmware version V15.03.05.14_multi. This particular vulnerability exposes a stack overflow situation in /goform/WifiWpsStart, which could potentially lead to remote arbitrary code execution by malicious actors.
This vulnerability is notable as the Tenda ac9 v1.0 router is a widely-used piece of hardware in both personal and professional environments. The consequences of a successful exploit could be severe, ranging from system compromise to data leakage, which could have a significant impact on both individuals and businesses alike.

Vulnerability Summary

CVE ID: CVE-2025-45429
Severity: Critical (9.8 CVSS Severity Score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise and potential data leakage.

Affected Products

Product | Affected Versions

Tenda ac9 v1.0 router | Firmware V15.03.05.14_multi

How the Exploit Works

The exploit takes advantage of a stack overflow vulnerability in the /goform/WifiWpsStart endpoint of the router’s firmware. A malicious actor could potentially send a specially crafted request to this endpoint, overflowing the stack and allowing them to execute arbitrary code remotely. This could lead to a complete system compromise, giving the attacker unrestricted access to the system and potentially leading to data leakage.

Conceptual Example Code

The following is a conceptual example of how the vulnerability might be exploited. This is a sample HTTP request that could be used to overflow the stack and execute arbitrary code:

POST /goform/WifiWpsStart HTTP/1.1
Host: target_router_ip
Content-Type: application/json
{ "malicious_payload": "A"*1024 }  // Stack overflow with 1024 'A' characters

Please note that this is only a conceptual example and actual payloads may vary. Nonetheless, the result of such an attack could be significant, leading to a system compromise or potential data leakage. It is therefore highly recommended that users of the affected product apply the vendor patch immediately or use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) as temporary mitigation.