Overview
CVE-2025-13446 is a high-severity vulnerability affecting Tenda AC21 routers, specifically version 16.03.08.16. This vulnerability is a stack-based buffer overflow that can be triggered remotely, allowing attackers to potentially execute arbitrary code on the affected device. The vulnerability lies in the handling of the `timeZone` and `time` arguments within the `/goform/SetSysTimeCfg` endpoint. Publicly available exploits exist, making immediate mitigation critical.
Technical Details
The vulnerability is a stack-based buffer overflow. The `SetSysTimeCfg` endpoint in the specified Tenda AC21 firmware version does not properly validate the length of the input provided for the `timeZone` and `time` parameters. By sending overly long strings in these parameters, an attacker can overwrite data on the stack, potentially gaining control of the device. The lack of proper input sanitization and boundary checks is the root cause of this issue.
CVSS Analysis
- CVSS Score: 8.8 (HIGH)
- This score indicates a significant risk. The vulnerability is remotely exploitable and could lead to complete system compromise.
Possible Impact
Successful exploitation of CVE-2025-13446 could have severe consequences, including:
- Remote Code Execution: Attackers could execute arbitrary code on the router, potentially gaining complete control of the device.
- Denial of Service (DoS): The router could become unstable and crash, disrupting network connectivity.
- Malware Installation: The router could be infected with malware, turning it into a botnet node or using it to launch attacks against other devices on the network.
- Data Theft: Sensitive data transmitted through the router could be intercepted and stolen.
- Network Hijacking: Attackers could change the router’s DNS settings, redirecting users to malicious websites.
Mitigation and Patch Steps
The following steps are recommended to mitigate the risk of CVE-2025-13446:
- Firmware Update: Check the Tenda website for a firmware update that addresses this vulnerability. Apply the update as soon as possible.
- Disable Remote Administration: If you don’t need to access your router remotely, disable remote administration features.
- Network Segmentation: If possible, segment your network to limit the impact of a compromised router.
- Monitor Network Traffic: Monitor your network traffic for suspicious activity.
- Firewall: Ensure your firewall is properly configured to block unauthorized access to your router.
