CVE-2025-45428

Deeper analysis

Tenda AC9 routers running firmware version V15.03.05.14_multi contain a stack-based buffer overflow in the rebootTime parameter processed by the /goform/SetSysAutoRebbotCfg endpoint. The flaw, tracked as CVE-2025-45428 and assigned CWE-121, permits unauthenticated remote attackers to supply oversized input that corrupts the stack and achieves arbitrary code execution. The vulnerability carries a CVSS 3.1 score of 9.8, reflecting network attack vector, low complexity, and no required credentials or user interaction.

An attacker with network reachability to the router's management interface can send a crafted HTTP request targeting the affected form handler. Successful exploitation grants full control over the device, allowing installation of persistent malware, interception of traffic, or use of the router as an entry point into the local network.

The two public references consist of identical GitHub disclosures that detail the parameter handling flaw and include proof-of-concept material; no vendor advisory or official patch information is referenced in the available sources.

EPSS scores for the CVE rose from a low baseline to a recorded peak of 0.0233 before settling at the current value of 0.0121, indicating measurable post-disclosure exploitation interest.