CVE-2025-5900 in AC9
Summary
by MITRE • 06/10/2025
A vulnerability, which was classified as problematic, was found in Tenda AC9 15.03.02.13. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/16/2025
This vulnerability in Tenda AC9 router firmware version 15.03.02.13 represents a critical cross-site request forgery flaw that poses significant security risks to network infrastructure. The issue falls under the CWE-352 category, which specifically addresses Cross-Site Request Forgery vulnerabilities in web applications and network devices. The vulnerability affects an unknown part of the device's web interface or management system, suggesting it may be located within the router's administrative web server component or API endpoints that handle configuration changes.
The technical nature of this CSRF vulnerability allows attackers to manipulate the device's functionality through malicious web requests without the user's knowledge or consent. Since the attack can be initiated remotely, an attacker does not require physical access to the device or network credentials to exploit the vulnerability. This remote exploit capability aligns with ATT&CK technique T1212, which covers exploitation of remote services through web-based attacks. The vulnerability enables unauthorized actions such as changing network settings, modifying user accounts, or altering security configurations that could compromise the entire network.
The operational impact of this vulnerability extends beyond simple configuration changes, as it could potentially allow attackers to gain persistent access to the network infrastructure. An attacker could leverage this CSRF flaw to redirect traffic, disable security features, or establish backdoor access points within the network. The fact that the exploit has been publicly disclosed increases the risk significantly, as it provides threat actors with readily available tools to target vulnerable Tenda AC9 devices. This situation creates a window of opportunity for malicious actors to compromise networks using the publicly available attack vectors.
Organizations should implement immediate mitigations including firmware updates from Tenda if available, network segmentation to isolate affected devices, and monitoring for suspicious network activity. Network administrators should also consider disabling unnecessary web management interfaces and implementing proper authentication controls. The vulnerability demonstrates the critical importance of maintaining up-to-date firmware in network infrastructure devices, as highlighted in industry best practices for cybersecurity defense. Additionally, organizations should conduct thorough vulnerability assessments to identify other potentially affected devices within their network infrastructure that may share similar vulnerabilities in their web management interfaces.