CVE-2025-29384

In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary…

Critical · published March 14, 2025

CVSS v3.1
9.8
EPSS
2%
Percentile
80.0
In the wild
Unconfirmed
What it is

🚨 A stack overflow in the wanMTU parameter of Tenda AC9 could let attackers run any code they want—like granting free access to your home network! 🔥 Think of this vulnerability as a restaurant where the chef can only cook a certain amount of dishes at once—if a delivery comes in with too many items, it could overwhelm the kitchen, leading to chaos and unauthorized meals being served. An attacker can exploit this vulnerability to execute arbitrary code remotely, potentially taking full control of your device. This means they could snoop on your network traffic, alter settings, or even launch further attacks against other devices on your network. It’s absolutely devastating to your security!

Put simply

Think of this vulnerability as a restaurant where the chef can only cook a certain amount of dishes at once—if a delivery comes in with too many items, it could overwhelm the kitchen, leading to chaos and unauthorized meals being served. This stack overflow vulnerability in Tenda AC9 v1.0 allows an attacker to send specially crafted data to the wanMTU parameter, leading to arbitrary code execution without authentication.

What to do

An attacker can exploit this vulnerability to execute arbitrary code remotely, potentially taking full control of your device. This means they could snoop on your network traffic, alter settings, or even launch further attacks against other devices on your network. It’s absolutely devastating to your security! Update your Tenda AC9 to the latest firmware version available, which addresses this vulnerability. Regularly check for firmware updates and ensure that any unnecessary remote access features are disabled. Don't forget to review your network security settings! You've got this! Follow these steps and secure your network like a pro! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01940 · 80.0th percentile
Published
2025-03-14T00:00Z
EPSS history
Timeline
  • 14 MAR 00:00Z
    In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary…
    cvelistv5