Introduction
Remote attackers can now exploit a critical memory flaw in Tenda AC20 routers to gain code execution or disrupt network operations. Exploit code is already public and no authentication is required, so the flaw leaves millions of home and small business networks at risk until it is addressed.
About Tenda: Tenda is a major global provider of consumer and SMB networking equipment, with millions of routers and wireless devices deployed worldwide. The AC20 is one of its popular dual-band gigabit routers and is widely used in homes and small offices. Tenda also sells switches and mesh WiFi systems, and it is a significant player in the affordable end of the networking market.
Technical Information
CVE-2025-13258 is a stack-based buffer overflow in the web management interface of the Tenda AC20 router, affecting firmware versions up to 16.03.08.12. The vulnerable code sits in the /goform/WifiExtraSet endpoint, which handles HTTP POST requests for advanced WiFi configuration.
The root cause is the handling of the wpapsk_crypto parameter. When /goform/WifiExtraSet receives a POST request, the firmware copies the user-supplied wpapsk_crypto value into a fixed-size stack buffer without checking its length. An attacker who sends an overly long value overflows the buffer and corrupts adjacent memory. The overflow can overwrite critical stack data such as return addresses, which opens the door to remote code execution or a denial of service.
The vulnerability is closely related to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input). Similar flaws in Tenda routers have been traced to unsafe functions like strcpy, which do not enforce length checks. Exploitation requires no authentication. A remote attacker only has to send a crafted HTTP POST request to the vulnerable endpoint, and public exploit code is available, which lowers the bar further.
Affected Systems and Versions
- Product: Tenda AC20 router
- Firmware versions: Up to and including 16.03.08.12
- Vulnerable endpoint:
/goform/WifiExtraSet - Vulnerable parameter:
wpapsk_crypto - No authentication required for exploitation
Vendor Security History
Tenda has a documented history of buffer overflow and input validation vulnerabilities across multiple router models, including:
- AC20: Multiple buffer overflows in different endpoints (CVE-2025-8160, CVE-2025-10120, CVE-2025-8940)
- AC21, AC18, AC8, CH22, AC1206: Similar issues reported in recent years
Patch response times have been inconsistent. Some critical flaws have remained unpatched for extended periods, and vendor advisories are often limited or delayed. Unsafe practices like unchecked string copying keep recurring, which indicates that Tenda's firmware development process still has security maturity problems.
