CVE-2025-25456

The vulnerability is a classic buffer overflow (CWE-120) — lack of proper validation of input data length for the mac2 parameter sent to the AdvSetMacMtuWan function. An attacker can provide specially crafted data that will overflow the stack buffer, overwriting critical memory areas. The attack is possible remotely, without authentication and without user interaction, making it particularly dangerous in network-exposed environments.

An attacker can gain full control of the device, leading to a breach of confidentiality, integrity and availability of the system, including potential arbitrary code execution (RCE) or permanent damage to the device.

Apply patches available from the manufacturer according to the references. Until an update is released, it is recommended to restrict access to the device's administrative interface only to trusted local networks and block access from the Internet using a firewall.

Tenda AC10 firmware version V4.0si_V16.03.10.20