CVE-2025-45428

The vulnerability results from insufficient validation of input data length for the rebootTime parameter sent to the /goform/SetSysAutoRebbotCfg endpoint. An excessively long parameter value causes stack buffer overflow (stack overflow, CWE-121), overwriting stack control data, including the function return address. The attacker can thus redirect code execution to their own payload, achieving remote code execution (RCE) without the need for authentication.

A remote attacker without any privileges can take full control of the device by executing arbitrary code (RCE), which potentially leads to violations of confidentiality, integrity, and system availability.

Apply patches available from the manufacturer according to the references. Until an update is released, it is recommended to restrict access to the device's administrative panel exclusively to trusted local networks and block access to the management interface from external networks using a firewall.

Tenda AC9 v1.0 with firmware V15.03.05.14_multi