CVE Alert: CVE-2025-10838 – Tenda – AC21

Risk verdict

High risk of remote code execution on affected Tenda AC21 devices, with a publicly available exploit and no user interaction required.

Why this matters

An attacker could take full control of the router, exfiltrate credentials, or pivot to devices on the LAN, potentially compromising other networked systems. Service disruption or configuration manipulation could undermine both privacy and business operations, especially in small offices or home deployments relying on this device.

Most likely attack path

Remote network access is sufficient (no user interaction, low attack complexity, low privileges required). The attacker can trigger a buffer overflow via wpapsk_crypto in WifiExtraSet, gaining code execution on the device. Because the scope is the device itself, immediate impact includes device compromise and potential explicit access to adjacent network resources.

Who is most exposed

Primarily consumer and SMB networks using the AC21 with WAN-facing management exposed. Environments where the router sits at the network perimeter or is directly accessible from the internet are at greater risk.

Detection ideas

• Logs showing unusual activity targeting /goform/WifiExtraSet or wpapsk_crypto payloads.
• Crashes or watchdog resets tied to WiFi configuration requests.
• Anomalous traffic patterns to the device’s management interfaces.
• Repeated failed or successful exploit-like connection attempts from external sources.
• Memory corruption indicators in device diagnostics or remote crash reports.

Mitigation and prioritisation

• Apply the vendor patch to 16.03.08.16 or newer as a priority.
• If patching is delayed, disable or restrict WAN-side administration; implement tight firewall rules to limit management access.
• Isolate affected devices from sensitive segments and monitor for post-exploit activity.
• Consider temporary mitigations such as disabling WifiExtraSet functions or hardening wpapsk_crypto handling where feasible.
• Change-management: track patch uptake and verify firmware integrity after update.