PT-2025-35174 · Tenda · Tenda Ac21 +1

Lxyilu · Published 2025-08-17 · Updated 2025-09-03 · CVE-2025-9605

Positive Technologies · (AI Summary)

CVSS v3.1

10

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda AC21 version 16.03.08.16 Tenda AC23 version 16.03.08.16

Description A stack-based buffer overflow vulnerability exists in the

GetParentControlInfo

function of the

/goform/GetParentControlInfo

file in Tenda AC21 and AC23 routers. Manipulation of the

mac

argument can trigger the overflow, allowing for remote exploitation. The exploit has been publicly disclosed.

Recommendations For Tenda AC21 version 16.03.08.16, disable remote management and segment networks. For Tenda AC23 version 16.03.08.16, disable remote management and segment networks.

Exploit

Fix

RCE

Buffer Overflow

Stack Overflow

Weakness Enumeration

CWE-119

CWE-121

Related Identifiers

BDU:2025-10636

CVE-2025-9605

Affected Products

Tenda Ac21

Tenda Ac23

References · 17

• 🔥 https://github.com/XXRicardo/iot-cve/blob/main/Tenda/AC21/AC21V1.0re_V16.03.08.16.md; · Exploit
• 🔥 https://github.com/XXRicardo/iot-cve/blob/main/Tenda/AC23/Stack-Based%20Buffer%20Overflow%20in%20Tenda%20Wi-Fi%205%20Router%20AC23%EF%BC%88AC23V1.0re_V16.03.07.52%EF%BC%89.md · Exploit
• 🔥 https://github.com/XXRicardo/iot-cve/blob/main/Tenda/AC21/AC21V1.0re_V16.03.08.16.md · Exploit
• https://bdu.fstec.ru/vul/2025-10636 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-9605 · Security Note
• https://t.me/CVEtracker/31206 · Telegram Post
• https://twitter.com/CveFindCom/status/1961257489292312942 · Twitter Post
• https://twitter.com/CVEnew/status/1961282392867704954 · Twitter Post
• https://vuldb.com/?id.321783 · Note
• https://twitter.com/offseq/status/1961262799172124996 · Twitter Post
• https://vuldb.com/?submit.636548 · Note
• https://twitter.com/VulmonFeeds/status/1961282608597217370 · Twitter Post
• https://twitter.com/cracbot/status/1963195326111666345 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1961284012485271805 · Twitter Post
• https://tenda.com.cn · Note