Introduction
An attacker who compromises a consumer router remotely can intercept traffic, pivot into the internal network, and stay undetected for months. CVE-2025-9523, which recently got a public exploit, puts home and small business networks that run Tenda AC1206 routers at critical risk.
About Tenda: Tenda is a global networking hardware manufacturer that makes wireless routers, switches, and related products. Its devices are widely deployed in consumer and SMB environments, so a single firmware vulnerability can expose a large number of networks. Tenda has a history of recurring security issues, including hard-coded credentials and multiple buffer overflow vulnerabilities.
Technical Information
CVE-2025-9523 is a stack-based buffer overflow in the GetParentControlInfo function of Tenda AC1206 router firmware version 15.03.06.23. An attacker triggers it by sending a manipulated mac parameter to the /goform/GetParentControlInfo HTTP endpoint.
Vulnerability mechanism:
- GetParentControlInfo retrieves parental control information for a connected device, based on that device's MAC address.
- The function copies the mac parameter from the HTTP request into a fixed-size stack buffer without proper bounds checking.
- An overly long mac value overruns the buffer and overwrites adjacent stack memory, including the function's return address.
- The attacker can then execute arbitrary code on the device remotely, without authentication.
Root cause: GetParentControlInfo does not validate the mac parameter. It copies that user input into a fixed-size stack buffer without checking its length.
Related vulnerabilities: Similar buffer overflows have been reported in the Tenda AC8 (a heap overflow in the same endpoint) and the AC15 (in the GetParentControlInfo function), which indicates the same implementation flaw recurring across Tenda router models.
None of the referenced sources include a public snippet of the vulnerable code.
Affected Systems and Versions
- Product: Tenda AC1206 router
- Firmware version: 15.03.06.23
- Public sources confirm only this firmware version as affected
- The vulnerability is in the /goform/GetParentControlInfo endpoint and is triggered through the mac parameter
Vendor Security History
- Tenda has a documented history of security issues, including:
- Hard-coded credentials in AC15 routers, with no firmware update since 2017
- Multiple buffer overflow vulnerabilities across the AC8, AC15, and other models
- Slow or absent responses to vulnerability disclosures
- Several Tenda vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog, which indicates active exploitation
- Public research and patch response records put Tenda's security maturity at low
