Introduction
Remote attackers can gain code execution on Tenda AC7 routers through a stack-based buffer overflow in the Dynamic DNS configuration endpoint. Public exploits are available and there is no official patch, so a single crafted HTTP request can compromise home and small business networks.
About Tenda: Tenda is a major Chinese networking equipment manufacturer with a global presence. It sells a wide range of consumer and SMB routers, access points, and switches. Tenda devices are deployed in millions of homes and small businesses worldwide, so a flaw in their firmware has a large impact on the broader IoT ecosystem.
Technical information
CVE-2025-11524 affects the Tenda AC7 router running firmware version 15.03.06.44. The vulnerability is in the /goform/SetDDNSCfg HTTP endpoint, which handles Dynamic DNS configuration changes. That endpoint processes a parameter named ddnsEn without proper bounds checking.
When a remote attacker sends an HTTP POST request to /goform/SetDDNSCfg with an overly long value for ddnsEn, the firmware copies the value into a fixed-size stack buffer. Nothing checks the length first, so the copy can overwrite adjacent stack memory, including control data such as return addresses. The attacker can then hijack execution flow and potentially run arbitrary code on the device.
The flaw is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow). Public exploit code shows that the attack is feasible and works remotely, as long as the attacker can reach the router's management interface.
Neither the vendor nor the public advisories have published a code snippet. Multiple independent sources and the public exploit documentation confirm the mechanism.
Affected systems and versions
- Product: Tenda AC7 wireless router
- Firmware version: 15.03.06.44 (latest known release)
- Endpoint:
/goform/SetDDNSCfg - Parameter:
ddnsEn - All configurations exposing the web management interface are vulnerable
Vendor security history
Tenda has a documented history of critical vulnerabilities in its router firmware, including:
- Stack-based buffer overflows in other endpoints (e.g., CVE-2025-1851, CVE-2025-29137)
- Command injection vulnerabilities (e.g., CVE-2024-48826)
- Hardcoded credentials and weak authentication mechanisms
Security researchers have reported slow or absent responses to vulnerability disclosures. Some Tenda models have gone several years without a firmware update, which raises concerns about how long Tenda supports its devices and how mature its security practices are.
