CVE Alert: CVE-2025-10443 – Tenda – AC9

Risk verdict

High risk of remote code execution on Tenda AC9/AC15 due to a buffer overflow in formexeCommand; a public PoC exists enabling network-based exploitation.

Why this matters

Compromise of the router could give an attacker full control of the device, with potential traffic interception, credential capture, and lateral movement into connected networks. In dense deployments, widespread exploitation could disrupt services, degrade customer experience, and enable further intrusions into downstream devices.

Most likely attack path

Exploitation would be delivered over the network to the /goform/exeCommand endpoint with crafted cmdinput. The vulnerability offers high impact (C/I/A) and is exploitable without user interaction, requiring only network access and low privileges. This supports rapid, automated targeting of exposed devices and potential immediate post-exploitation control and persistence within the device’s environment.

Who is most exposed

Common in home and small-office deployments where WAN management interfaces are reachable from the internet or misconfigured, and where firmware updates are infrequent. Consumer-grade routers like Tenda AC9/AC15 are popular in SMBs and households, increasing blast radius if not updated.

Detection ideas

• Look for repeated, unusual /goform/exeCommand requests with long or crafted cmdinput.
• Detect device reboots, crashes, or memory corruption indicators in logs.
• Monitor for atypical outbound connections or data patterns from the router.
• IDS/IPS alerts matching known PoC patterns or overflow signatures.
• Unexpected new processes or core dumps on the device.

Mitigation and prioritisation

• Update to patched firmware as soon as vendor releases it; verify integrity before deployment.
• If patching is not immediately possible, disable or tightly restrict remote/WAN admin access; apply strict firewall rules to block external administration.
• Enforce network segmentation and isolate affected devices from sensitive networks; restrict admin exposure to LAN only.
• Review credentials and disable unnecessary services; enable automatic updates if available.
• Plan a device replacement or upgrade for discontinued support; document a change-management timeline.