CVE-2025-7544

The vulnerability present in the Tenda AC1206 firmware version 15.03.06.23 is characterized by a stack-based buffer overflow in the function responsible for setting MAC filter configurations. This flaw arises from improper handling of the input parameter, specifically the deviceList argument. When an attacker manipulates this argument, it can lead to the overflow of the stack memory, allowing for arbitrary code execution. This vulnerability is particularly critical due to its remote exploitability, which means that an attacker does not need physical access to the device to initiate an attack. The potential for remote exploitation significantly increases the attack surface, making it a pressing concern for users of this router model.

Attack vectors for this vulnerability are diverse, primarily leveraging the web interface of the router. An attacker could craft a malicious HTTP request that includes a specially formatted deviceList parameter. If the router processes this request without adequate input validation, the overflow could overwrite the return address on the stack, redirecting execution to the attacker's code. This could lead to a complete compromise of the device, allowing the attacker to gain control over the router, intercept traffic, or even pivot to other devices on the same network. Given the nature of home networking devices, such attacks could be executed by individuals with minimal technical expertise, further amplifying the risk.

The real-world impact of this vulnerability extends beyond the immediate compromise of the affected router. For businesses relying on Tenda AC1206 routers, the risks include unauthorized access to sensitive data, potential data breaches, and the possibility of being used as a launchpad for further attacks within the corporate network. Additionally, the public disclosure of this vulnerability means that threat actors are likely to develop and deploy exploit code rapidly, increasing the urgency for organizations to address the issue. The reputational damage associated with a successful exploitation could also lead to loss of customer trust and financial repercussions.

To detect and mitigate the risks associated with this vulnerability, organizations should implement a multi-faceted approach. Regularly updating firmware to the latest versions is crucial, as manufacturers often release patches to address known vulnerabilities. Network monitoring tools can be employed to detect unusual traffic patterns or unauthorized access attempts, providing an additional layer of security. Furthermore, organizations should consider implementing network segmentation to limit the exposure of critical systems to potentially compromised devices. Educating users about the importance of changing default credentials and employing strong passwords can also reduce the likelihood of exploitation.

In conclusion, the stack-based buffer overflow vulnerability in the Tenda AC1206 firmware presents a significant threat due to its remote exploitability and potential for widespread impact. Organizations must prioritize the identification and remediation of this issue to safeguard their networks and data. By adopting proactive detection and mitigation strategies, they can effectively reduce the risks associated with this and similar vulnerabilities in the future.

Recent CSURFACE threat intelligence indicates a modest increase in the Exploit Prediction Scoring System (EPSS) for CVE-2025-7544, rising by approximately 11.3%. While this numerical uptick remains relatively low in absolute terms, it reflects a subtle shift in the likelihood of exploitation attempts targeting the stack-based buffer overflow vulnerability in the Tenda AC1206 device. Our telemetry shows that this change has stabilized over the past week without a rapid surge, suggesting a cautious but persistent interest from threat actors. Although no new exploit variants or proof-of-concept codes have been identified, the incremental rise in EPSS underscores a growing potential for adversaries to leverage this vulnerability remotely. For defenders, this development signals the need to maintain vigilance and monitor for any emerging exploitation trends, as even slight increases in exploitability scores can precede broader attack campaigns. Consequently, the overall threat level should be regarded as cautiously elevated, warranting continued attention in vulnerability management processes.

Update 2 — May 18, 2026

CSURFACE threat intelligence has identified a marked escalation in detection activity related to CVE-2025-7544, with our telemetry indicating a rapid increase in exploit probability scores over the past week. This surge reflects a growing adversary interest in leveraging the stack-based buffer overflow vulnerability within the Tenda AC1206’s formSetMacFilterCfg function. Although no new exploit variants or proof-of-concept codes have been observed, the sharp rise in EPSS and the increasing trend in exploit attempts suggest that threat actors are actively probing or preparing to weaponize this flaw. For defenders, this development signals an elevated risk environment where opportunistic exploitation could become more frequent, particularly given the vulnerability’s remote attack vector and critical severity. Consequently, the threat level associated with CVE-2025-7544 should be considered heightened, warranting intensified monitoring and prioritization within vulnerability management frameworks.

Update 3 — June 07, 2026

CSURFACE threat intelligence has detected a marked escalation in attempts to exploit CVE-2025-7544, with our telemetry indicating a significant uptick in probing activity targeting the vulnerable Tenda AC1206 devices. This increase in hostile engagement, despite a stable EPSS score, suggests that adversaries are intensifying reconnaissance efforts, potentially in preparation for broader exploitation campaigns. The absence of new exploit variants does not diminish the heightened operational tempo observed; instead, it underscores a growing interest in weaponizing this critical stack-based buffer overflow remotely. For defenders, this evolving threat landscape elevates the urgency to monitor network traffic for anomalous requests to the affected endpoint, as opportunistic exploitation attempts are becoming more frequent and persistent. Consequently, the risk level associated with CVE-2025-7544 should be considered elevated beyond prior assessments, reflecting an increased likelihood of successful compromise in the near term.

Update 4 — July 05, 2026

CSURFACE threat intelligence has identified a slight increase in exploitation attempts targeting the Tenda AC1206 vulnerability, with our telemetry indicating a modest uptick in probing activity directed at the vulnerable endpoint. Although the overall exploit landscape remains unchanged with no new proof-of-concept exploits emerging, this subtle rise in hostile activity suggests adversaries are maintaining persistent interest in leveraging the stack-based buffer overflow remotely. This continued probing, coupled with the critical severity of the vulnerability, signals an elevated operational tempo that could facilitate opportunistic intrusions if left unmonitored. Consequently, the threat level associated with CVE-2025-7544 should be considered moderately heightened, reflecting a growing probability of successful exploitation attempts in the near term.