CVE-2025-10443 in AC9
Summary
by MITRE • 09/15/2025
A vulnerability was identified in Tenda AC9 and AC15 15.03.05.14/15.03.05.18. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Such manipulation of the argument cmdinput leads to buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2025
The vulnerability CVE-2025-10443 represents a critical buffer overflow flaw in Tenda AC9 and AC15 wireless routers running firmware versions 15.03.05.14 and 15.03.05.18. This issue resides within the formexeCommand function located in the /goform/exeCommand file, which serves as a remote execution interface for the device's web administration portal. The vulnerability stems from inadequate input validation and sanitization of the cmdinput parameter, which allows attackers to manipulate the command execution flow through crafted malicious input. This particular implementation exposes a dangerous path where user-supplied data directly influences system command execution without proper bounds checking, creating an exploitable condition that can be leveraged remotely by threat actors.
The technical exploitation of this vulnerability follows a classic buffer overflow pattern where an attacker can overflow the allocated buffer space in the cmdinput argument, potentially overwriting adjacent memory locations and gaining control over the device's execution flow. This type of vulnerability maps directly to CWE-121, which describes buffer overflow conditions where insufficient bounds checking allows attackers to overwrite adjacent memory. The remote execution capability of this flaw means that an attacker does not require physical access to the device or network proximity to exploit the vulnerability, making it particularly dangerous in enterprise and residential network environments. The publicly available exploit for this vulnerability significantly increases the risk surface, as it removes the need for advanced exploitation techniques and allows even less sophisticated attackers to compromise affected devices.
The operational impact of CVE-2025-10443 extends beyond simple device compromise, as it provides attackers with potential access to the entire network infrastructure controlled by these routers. Once exploited, attackers can execute arbitrary commands on the affected devices, potentially leading to complete network takeover, data exfiltration, or the installation of persistent backdoors. The vulnerability affects a wide range of Tenda AC9 and AC15 models, which are commonly deployed in both residential and small business environments, making the potential attack surface extensive. These devices typically serve as the primary gateway between internal networks and the internet, meaning successful exploitation could allow attackers to establish persistent access points within networks, conduct man-in-the-middle attacks, or use the compromised devices as launching platforms for further attacks against other networked systems.
Security professionals should implement immediate mitigations including firmware updates from Tenda to address the buffer overflow condition in the formexeCommand function. Network segmentation and access control measures should be deployed to limit the potential impact of any successful exploitation attempts. The vulnerability aligns with ATT&CK technique T1059.007 for Command and Scripting Interpreter, where adversaries leverage system command execution capabilities to gain control of affected systems. Organizations should also monitor network traffic for suspicious command execution patterns and consider implementing network intrusion detection systems to identify potential exploitation attempts. Given the publicly available exploit, the window for remediation is critical, and administrators should prioritize updating affected devices while maintaining vigilance for any signs of compromise in their network infrastructure.