CVE-2025-29384

CRITICAL

Tenda AC9 v1.0 V15.03.05.14_multi - Stack Overflow via wanMTU Parameter

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2025-29384. PoCs published by Otsmane-Ahmed, Fomovet.

AI-analyzed exploit summary This repository contains a Python-based PoC exploit and a Ruby Metasploit module for CVE-2025-29384, a stack-based buffer overflow in Tenda AC9 routers (firmware V15.03.05.14_multi). The exploit targets the `/goform/AdvSetMacMtuWan` endpoint via an oversized `wanMTU` parameter, leading to DoS and potential RCE.

Description

In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code execution.

Exploits (2)

nomisec WORKING POC 5 stars

by Otsmane-Ahmed · poc

https://github.com/Otsmane-Ahmed/cve-2025-29384-poc

View Code ZIP pw:eip

This repository contains a Python-based PoC exploit and a Ruby Metasploit module for CVE-2025-29384, a stack-based buffer overflow in Tenda AC9 routers (firmware V15.03.05.14_multi). The exploit targets the `/goform/AdvSetMacMtuWan` endpoint via an oversized `wanMTU` parameter, leading to DoS and potential RCE.

Classification

Working Poc 95%

Attack Type

Dos, Rce

Complexity

Moderate

Reliability

Reliable

Target: Tenda AC9 firmware V15.03.05.14_multi

No auth needed

Prerequisites: Python 3.x · Metasploit Framework (for Ruby module) · Network access to vulnerable Tenda AC9 router

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution

mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

github WORKING POC

by Fomovet · pythonpoc

https://github.com/Fomovet/cve-2025-29384

View Code ZIP pw:eip

This repository contains a functional proof-of-concept exploit for CVE-2025-29384, a stack-based buffer overflow in Tenda AC9 routers. The exploit targets the `/goform/AdvSetMacMtuWan` endpoint with an oversized payload to trigger a denial-of-service or potential RCE.

Classification

Working Poc 95%

Attack Type

Dos | Rce

Complexity

Moderate

Reliability

Reliable

Target: Tenda AC9 router (firmware V15.03.05.14_multi)

No auth needed

Prerequisites: Network access to the target router · Router running vulnerable firmware

MITRE ATT&CK

T1499 - Endpoint Denial of Service T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

mistral-large-3 · analyzed Jun 21, 2026 Full analysis →

References (1)

Core 1

Core References

Exploit, Third Party Advisory

https://github.com/shuqi233/loophole/blob/main/Tenda%20AC9/AdvSetMacMtuWan1.md

View Exploit ZIP pw:eip

Scores

CVSS v3 9.8

EPSS 0.0176

EPSS Percentile 75.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-787

Status published

Products (1)

tenda/ac9_firmware 15.03.05.14

Published Mar 14, 2025

Tracked Since Feb 18, 2026