CVE-2025-22949
Published: 10 January 2025
Summary
CVE-2025-22949 is a critical-severity Command Injection (CWE-77) vulnerability in Tenda Ac9 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the insufficient input validation in the /goform/SetSambaCfg endpoint that enables command injection.
Requires identification, reporting, and correction of the specific command injection flaw via firmware remediation.
Restricts classes of inputs to the vulnerable endpoint, limiting the ability to submit command injection payloads.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated command injection in public router web endpoint directly enables remote OS command execution (T1190 initial access + T1059.004 Unix Shell).
NVD Description
Tenda ac9 v1.0 firmware v15.03.05.19 is vulnerable to command injection in /goform/SetSambaCfg, which may lead to remote arbitrary code execution.
Deeper analysisAI
CVE-2025-22949 is a command injection vulnerability (CWE-77) affecting the Tenda AC9 v1.0 router running firmware version v15.03.05.19. The flaw resides in the /goform/SetSambaCfg endpoint, where insufficient input validation allows attackers to inject and execute arbitrary operating system commands. Published on 2025-01-10, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its high impact on confidentiality, integrity, and availability.
Remote attackers can exploit this vulnerability over the network without authentication or user interaction. By sending a specially crafted HTTP request to the vulnerable endpoint, an unauthenticated adversary gains the ability to execute arbitrary code on the device, potentially leading to full remote code execution (RCE) and complete compromise of the router.
For mitigation details, refer to the advisory at https://noisy-caravel-a9a.notion.site/Tenda_AC9V1-0_V15-03-05-19_formSetSambaConf_doSystemCmd_CI-16f898c94eac80d5801bdaf777ac2b27, which documents the command injection in the doSystemCmd function.
Details
- CWE(s)