Introduction
Remote attackers can gain control of Tenda AC7 routers running firmware version 15.03.06.44 by exploiting a stack-based buffer overflow in the web management interface. Public exploit code is available, which leaves consumer and small business networks open to code execution and device compromise.
Tenda makes consumer and small business networking equipment, sells it worldwide, and has millions of devices deployed. The AC7 is a popular wireless router, so flaws in its firmware can put home and office networks at real risk.
Technical information
CVE-2025-11528 is a stack-based buffer overflow in Tenda AC7 router firmware version 15.03.06.44. The flaw is in the /goform/saveAutoQos endpoint, part of the router's web management interface. When the firmware handles an HTTP POST request to this endpoint, it parses the enable parameter and stores its value in a fixed-size buffer on the stack. It does not properly check the length of the user-supplied enable value before copying it into that buffer.
An oversized enable value overflows the buffer and can overwrite adjacent stack memory, including the function's return address. That may let an attacker redirect execution flow and achieve remote code execution on the device. The vulnerability is classified under CWE-121 (Stack-based Buffer Overflow) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The attack works remotely over network access to the web interface, and it needs no prior authentication if the management interface is exposed.
The public exploit code shows how to trigger the overflow and potentially execute arbitrary code. No official patch or detection guidance has been published at the time of writing.
Affected systems and versions
- Product: Tenda AC7 wireless router
- Firmware version: 15.03.06.44
- The vulnerability affects the
/goform/saveAutoQosendpoint - Public sources confirm only this specific firmware version as affected
Vendor security history
Tenda has a documented history of buffer overflow vulnerabilities in its routers, often in the /goform/ endpoints. Earlier CVEs such as CVE-2025-11325, CVE-2025-11327, and CVE-2025-11123 describe similar stack-based buffer overflows in other Tenda models and firmware versions. Tenda's response to these issues has been inconsistent, and official advisories and patches for several critical vulnerabilities arrived late or not at all. The pattern suggests recurring problems with secure coding and vulnerability management in Tenda's development process.
