CVE Alert: CVE-2025-12596 – Tenda – AC23

Risk verdict

High risk due to a remote buffer overflow with publicly disclosed exploit; treat as priority pending confirmation of KEV/EPSS exploitation signals.

Why this matters

Remote attacker could trigger the overflow via the management endpoint and gain control of the device, with potential data exposure or disruption of network services. Compromise of a consumer router can enable payload delivery to clients, enable lateral movement within the local network, and degrade business continuity in remote or branch-office deployments.

Most likely attack path

Exploitation is network-based and requires low privileges with no user interaction. An attacker can target the saveParentControlInfo routine remotely, sending crafted input to Time to overwrite memory, achieve code execution and persist within the device. The lack of UI interaction raises the probability of automated, mass-target attempts and rapid laddered access to adjacent devices on the LAN.

Who is most exposed

Commonly deployed in homes and SMBs with WAN-facing management interfaces enabled; devices in unsegmented networks or with weak firmware controls are particularly vulnerable to mass scanning and exploitation.

Detection ideas

• Logs showing crashes or unusual memory corruption events tied to /goform/saveParentControlInfo.
• Anomalous spikes in traffic to the management endpoint without authentication.
• Unexpected admin session creations or remote configuration changes.
• Crashes or reboots following crafted requests to Time parameter.
• Indicators of exploit payloads or known IOCs from CTI feeds.

Mitigation and prioritisation

• Apply vendor patch/firmware upgrade to the fixed version.
• Disable or tightly restrict remote management exposure; enforce allowlists for admin access.
• Implement network segmentation and monitor for anomalous admin activity.
• Ensure robust input validation on management endpoints; review related logging.
• If KEV is true or EPSS ≥ 0.5, treat as priority 1; otherwise prioritise patching within the high-severity window and verify compensating controls.