Introduction
Remote attackers can take control of Tenda AC20 routers in home and office networks through a buffer overflow in the parental control interface. Exploit code is public and the attack needs no authentication, so any unpatched device running affected firmware is at significant risk.
Tenda is a major manufacturer of consumer and small business networking equipment, with a global presence and millions of deployed devices. The AC20 is a popular dual-band router, common in homes and small offices. Memory safety and input validation vulnerabilities have turned up in Tenda's product line again and again, which raises concerns that its security problems are systemic.
Technical information
CVE-2025-10120 is a stack-based buffer overflow in Tenda AC20 routers running firmware up to 16.03.08.12. The bug is in the web management interface, in the handler for the /goform/GetParentControlInfo endpoint. When the firmware processes an HTTP POST request, it copies the user-supplied mac parameter into a fixed-size stack buffer with strcpy. Because strcpy does not check the length of the source string, a long mac value overflows the buffer. That can overwrite the function's return address and allow remote code execution.
The root cause is that the firmware does not validate the input and uses strcpy, an unsafe function, to copy externally supplied data. This is a textbook case of CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input). The endpoint is reachable through the web interface, and triggering the flaw requires no authentication.
Similar vulnerabilities have been reported in other endpoints and other Tenda models, often with the same unsafe string handling and missing bounds checks. Exploitability is high because the attack works remotely and needs no authentication.
Affected systems and versions
- Tenda AC20 routers running firmware up to 16.03.08.12
- The vulnerable endpoint is
/goform/GetParentControlInfo - All configurations exposing the web management interface are at risk
Vendor security history
Tenda has a documented history of memory safety and input validation flaws in its router firmware. Notable recent vulnerabilities include:
- CVE-2025-8160: Buffer overflow in
/goform/SetSysTimeCfg(AC20, up to 16.03.08.12) - CVE-2025-8940: Buffer overflow in
/goform/saveParentControlInfo(AC20, up to 16.03.08.12) - CVE-2025-9090: Command injection in
/goform/telnet(AC20, 16.03.08.12) - CVE-2025-9523: Stack buffer overflow in
GetParentControlInfo(AC1206)
Patch response times have been inconsistent, and the same kinds of vulnerabilities have come back across multiple product lines and firmware versions. Tenda's communication and disclosure have not always given users timely or detailed guidance.
