Introduction
Attackers can remotely compromise Tenda AC20 routers running firmware 16.03.08.05 by exploiting a stack-based buffer overflow in the device's web management interface. Public exploit code is available, which makes this a high-risk issue for any organization or individual using affected hardware.
Tenda is a networking equipment vendor known worldwide, with a large presence in the consumer and SMB router market. The AC20 is widely deployed in homes and small offices. Tenda's firmware has drawn repeated security scrutiny because of recurring vulnerabilities, especially memory safety and input validation flaws.
Technical Information
CVE-2025-9791 is a stack-based buffer overflow in firmware version 16.03.08.05 of the Tenda AC20 router. The flaw is in the /goform/fromAdvSetMacMtuWan endpoint of the web management interface. An attacker can trigger it by sending a crafted HTTP POST request with a manipulated wanMTU parameter.
The firmware copies the wanMTU value into a stack buffer without sufficient bounds checking. A remote attacker can overflow that buffer and may be able to execute arbitrary code on the device. The attacker does not need to authenticate, which makes the flaw much easier to exploit.
No public code snippet is available for this CVE. Similar vulnerabilities in Tenda AC20 firmware have involved unsafe use of string copy functions such as strcpy without proper input validation. The same pattern appears across multiple endpoints in Tenda firmware, which points to a systemic problem with input handling.
Affected Systems and Versions
- Product: Tenda AC20 router
- Firmware version: 16.03.08.05
- Vulnerable endpoint:
/goform/fromAdvSetMacMtuWan - Vulnerable parameter:
wanMTU - All configurations exposing the web management interface are potentially vulnerable
Vendor Security History
Tenda's router firmware, and the AC20 product line in particular, has a documented history of security issues. Examples include:
- CVE-2025-8810: Stack-based buffer overflow in
/goform/SetFirewallCfg(firmware 16.03.08.05) - CVE-2025-8160: Buffer overflow in
/goform/SetSysTimeCfg(firmware up to 16.03.08.12) - CVE-2025-9091: Hard-coded credentials in firmware 16.03.08.12
Tenda's patch response has been inconsistent, and some vulnerabilities have stayed unpatched for long periods. The recurring root causes are unsafe string handling and missing input validation.
