Introduction
A critical buffer overflow in the web management interface of Tenda AC20 routers lets remote attackers take control of devices running older firmware. An unauthenticated attacker can use it to execute code or to cause a denial of service, and small office and home networks that leave it unaddressed are at significant risk.
Tenda makes a wide range of routers, switches, and wireless devices, and its hardware is deployed in consumer and SMB environments around the world. The AC20 is a dual-band router that is popular for its affordability and feature set, which makes it a common choice for small businesses and home users worldwide. Because Tenda's market reach is so broad, a vulnerability in its products can have a substantial impact on network security for a large user base.
Technical Information
The vulnerability is in the httpd component of Tenda AC20 routers running firmware versions up to and including 16.03.08.12. It affects the /goform/SetSysTimeCfg endpoint, which accepts HTTP POST requests and processes the timeZone parameter that clients send.
The root cause is insufficient bounds checking when the router copies the timeZone value into a fixed-size stack buffer. Public analysis indicates that the code likely uses unsafe string handling functions such as strcpy, so an attacker can supply an overly long timeZone value. The resulting overflow can corrupt adjacent memory, including the function's return address or other stack variables. That corruption enables remote code execution, or it can crash the web server process and cause a denial of service.
The attack works remotely and needs no authentication. An attacker only has to send an HTTP POST request to the vulnerable endpoint with a maliciously long timeZone parameter. Exploit details are public, which increases the likelihood that attackers will target this vulnerability in the wild.
Affected Systems and Versions
- Tenda AC20 routers with firmware versions up to and including 16.03.08.12
- Only the
/goform/SetSysTimeCfgendpoint in the httpd component is confirmed as vulnerable - No information is available about other Tenda models or firmware versions
Vendor Security History
Tenda has a documented history of similar vulnerabilities in its routers. CVE-2025-8131 is a stack-based buffer overflow in the AC20 through the /goform/SetStaticRouteCfg endpoint. CVE-2025-6887 is a buffer overflow in the /goform/SetSysTimeCfg endpoint of the AC5 router. The repetition suggests that Tenda's web management interfaces have a persistent problem with handling user input safely. Tenda's response times to past vulnerabilities have varied, and as of this writing there is no confirmed patch or mitigation for CVE-2025-8160.
