Introduction
Remote attackers can gain control of Tenda AC21 and AC23 routers running firmware 16.03.08.16 by exploiting a stack-based buffer overflow in the parental control interface. The vulnerability has a CVSS score of 9.8 and public proof-of-concept code, and it exposes millions of consumer and SMB networks to code execution and device takeover.
Tenda is a major global manufacturer of networking equipment, and a wide range of its routers are deployed in homes and small businesses worldwide. Its product lines have had recurring buffer overflow vulnerabilities, which raises concerns about the security maturity of its firmware development practices.
Technical Information
CVE-2025-9605 is in the GetParentControlInfo function of Tenda AC21 and AC23 routers running firmware version 16.03.08.16. The function is reachable through the /goform/GetParentControlInfo endpoint in the web management interface. When a POST request carries an overly long mac parameter, the function copies the value into a fixed-size stack buffer without proper bounds checking. The result is a stack-based buffer overflow (CWE-121) that can overwrite critical stack data such as return addresses, and from there lead to arbitrary code execution.
An attacker can exploit the vulnerability remotely, and no authentication is required. The root cause is missing input validation and bounds checking on user-supplied data in a security-critical function. Other Tenda routers, including the AC1206 and AC20, have had similar vulnerabilities, which points to a systemic problem in Tenda's firmware codebase.
Proof of Concept
A proof-of-concept (PoC) exploit has been developed for the Tenda AC21 router on firmware version V16.03.08.16. It uses the stack-based buffer overflow in the GetParentControlInfo function, reached through the /goform/GetParentControlInfo endpoint.
The attacker sends a specially crafted POST request to this endpoint with an excessively long value in the mac parameter. That value can overflow the buffer allocated for it and cause a stack overflow. The overflow can disrupt the program's normal execution flow and may let the attacker execute arbitrary code on the device.
The PoC shows that an attacker can use this vulnerability to gain unauthorized access to the router's system, which may lead to complete compromise of the device. From there, an attacker could take control of network traffic, intercept sensitive data, or attack other devices connected to the network.
The exploit can be run remotely and does not need physical access to the device. Success may depend on the attacker being able to send crafted requests to the router's web interface, and network configuration and access controls could limit that.
The original PoC documentation has a detailed walkthrough of the exploit and its implications.
References:
- https://dbugs.ptsecurity.com/vulnerability/PT-2025-35174
- https://github.com/XXRicardo/iot-cve/blob/main/Tenda/AC21/AC21V1.0re_V16.03.08.16.md
Detection Methods
Finding vulnerabilities in Tenda devices such as the AC21 router takes a combination of static and dynamic analysis. Static analysis tools like LuaTaint can examine the firmware's code for security flaws without running it. LuaTaint combines static taint analysis with large language models to find vulnerabilities in the web configuration interfaces of IoT devices, with a detection precision of up to 89.29%. (arxiv.org)
Dynamic analysis monitors the device while it runs, looking for anomalies that indicate exploitation attempts. A study of Tenda CP3 IP cameras used both static and dynamic analysis to find remotely exploitable vulnerabilities, and the work turned up five new CVEs with CVSS scores from 7.5 to 9.8. (arxiv.org)
Intrusion prevention systems (IPS) can also be configured to detect and block malicious HTTP requests aimed at known vulnerabilities in Tenda devices. FortiGuard Labs, for example, provides IPS signatures that identify attack attempts against Denial of Service vulnerabilities in Tenda devices by matching specific patterns in HTTP requests. (fortiguard.fortinet.com)
Each method covers a different stage. Static analysis finds vulnerabilities ahead of time, dynamic analysis watches for attacks in real time, and IPS blocks threats as they arrive. Organizations running Tenda devices can use all three together.
Affected Systems and Versions
- Tenda AC21 router, firmware version 16.03.08.16
- Tenda AC23 router, firmware version 16.03.08.16
Available data does not confirm any other firmware versions or models as affected. The vulnerability is in the GetParentControlInfo function exposed through /goform/GetParentControlInfo.
Vendor Security History
Tenda has a documented history of buffer overflow vulnerabilities across multiple router models:
- AC11: CVE-2021-31755
- AC15: CVE-2020-10987
- AC7, AC9, AC10: CVE-2018-14558
- AC1206: CVE-2025-9523
- AC20: CVE-2025-8160
Several of these vulnerabilities have been included in CISA's Known Exploited Vulnerabilities catalog. Tenda's patch response times have been inconsistent, and some models have gone years after disclosure without a firmware update. The same kinds of flaws keep recurring, which suggests systemic problems in Tenda's firmware development and security review processes.
