cbcvebase.
CVE-2025-45429
published 2025-04-23

CVE-2025-45429: In the Tenda ac9 v1.0 router with firmware V15.03.05.14_multi, there is a stack overflow vulnerability in /goform/WifiWpsStart, which may lead to remote…

PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.86%
54.4th percentile
In the Tenda ac9 v1.0 router with firmware V15.03.05.14_multi, there is a stack overflow vulnerability in /goform/WifiWpsStart, which may lead to remote arbitrary code execution.

Affected

1 ranges
VendorProductVersion rangeFixed in
tendaac9_firmware——

Detection & IOCsextracted from sources · hover to see the quote

urlhttps://github.com/SolitaryGrass/IoT_vuln/blob/main/tenda/AC6/AC6V2.0RTL_V15.03.06.23/formWifiWpsStart/poc.py↗
path/goform/WifiWpsStart↗
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Tenda WifiWpsStart index Parameter Buffer Overflow Attempt (CVE-2025-45429, CVE-2024-2896, CVE-2024-2811, CVE-2024-2706)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:20; content:"/goform/WifiWpsStart"; fast_pattern; http.request_body; content:"index|3d|"; pcre:"/^[^&]{100,}(?:&|$)/R"; reference:cve,2025-45429; reference:url,github.com/SolitaryGrass/IoT_vuln/blob/main/tenda/AC6/AC6V2.0RTL_V15.03.06.23/formWifiWpsStart/poc.py; reference:cve,2024-2811; reference:cve,2024-2706; reference:cve,2024-2896; classtype:web-application-attack; sid:2064111; rev:1; metadata:affected_product Tenda, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_08_22, cve CVE_2025_45429_CVE_2024_2896_CVE_2024_2811_CVE_2024_2706, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_08_22, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
  • →Exploit targets HTTP POST requests to /goform/WifiWpsStart with an oversized `index` parameter (>=100 chars before & or end of body), triggering a stack overflow.
  • →The `index` POST body parameter is the overflow vector; monitor for values exceeding 100 bytes in requests to this endpoint.
  • →Traffic is expected in plaintext (no TLS); deploy detection at perimeter and internal network boundaries.
  • →The Snort/Suricata rule SID 2064111 (ET, rev:1) directly covers this CVE alongside related Tenda WPS stack overflow variants CVE-2024-2896, CVE-2024-2811, CVE-2024-2706.
  • ·Vulnerable device is specifically Tenda AC9 v1.0 with firmware V15.03.05.14_multi; the Snort rule references AC6 V15.03.06.23 PoC, suggesting the same endpoint is shared across multiple Tenda firmware lines. ↗
  • ·The Snort rule URI match uses `bsize:20`, meaning it matches only when the URI is exactly 20 bytes (/goform/WifiWpsStart); ensure your IDS/IPS does not strip trailing slashes or query strings before matching.
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.