CVE-2025-0528
Published: 17 January 2025
Summary
CVE-2025-0528 is a high-severity Injection (CWE-74) vulnerability in Tenda Ac8 Firmware. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring timely identification, reporting, and patching of the command injection flaw in the Tenda router firmware.
Prevents exploitation of the command injection vulnerability by enforcing input validation mechanisms on HTTP requests to the /goform/telnet endpoint.
Limits the impact of the PR:H requirement by enforcing least privilege, reducing the number of accounts able to access and exploit the vulnerable HTTP handler.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection via HTTP on public-facing router web interface (T1190) enables execution of arbitrary commands on the network device CLI (T1059.008) through indirect command execution (T1202).
NVD Description
A vulnerability, which was classified as critical, has been found in Tenda AC8, AC10 and AC18 16.03.10.20. Affected by this issue is some unknown functionality of the file /goform/telnet of the component HTTP Request Handler. The manipulation leads to command…
more
injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-0528 is a critical command injection vulnerability (CVSS 7.2, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) affecting Tenda AC8, AC10, and AC18 routers on firmware version 16.03.10.20. The flaw impacts an unknown functionality in the /goform/telnet endpoint of the HTTP Request Handler component, stemming from CWE-74 (Improper Neutralization of Special Elements), CWE-77 (Command Injection), and CWE-78 (OS Command Injection).
A remote attacker with high privileges (PR:H) can exploit the vulnerability by manipulating HTTP requests to the affected endpoint, enabling arbitrary command execution without user interaction. Exploitation results in high impacts across confidentiality, integrity, and availability (C:H/I:H/A:H), potentially allowing full device compromise such as unauthorized access, data exfiltration, or persistent control.
Advisories from VulDB and a public GitHub repository detail the issue, confirming remote exploitability and providing a proof-of-concept in the form of a Markdown write-up for Tenda AC10 v16.03.10.20 telnet access. The Tenda vendor website is referenced for potential updates, though no specific patches are detailed in the available information; practitioners should monitor these sources for mitigation guidance.
Details
- CWE(s)