CVE-2025-11549: High Stack Overflow in Tenda W12 Access Point

CVE-2025-11549 is a high severity (CVSS 8.8) stack based buffer overflow in Tenda W12 firmware 3.0.0.6(3948), in the wifiMacFilterSet function. No fixed firmware is confirmed. Turn off remote management, use strong credentials and check Tenda support for an update.

What's affected

• Product: Tenda W12 wireless access point
• Affected firmware: 3.0.0.6(3948)
• Weak point: wifiMacFilterSet in /goform/modules (HTTP request handler), argument mac
• Fixed firmware: none confirmed in the sources reviewed. Check the Tenda support and download pages for your model

The researcher report describes a handler that reads a list of MAC addresses from a request and copies a value into a fixed stack buffer without checking its length. The record puts it in the HTTP request handler component.

The weakness is CWE-121 (stack based buffer overflow) under CWE-119 (improper restriction of operations within the bounds of a memory buffer). The CVSS score is 8.8 (High). The vector calls for a network attack with a low privilege account and no user interaction, and rates confidentiality, integrity and availability impact as high.

How to check if you're exposed

Routers and access points do not use a package manager, so check the firmware version and the network exposure.

1. Sign in to the device web interface from the LAN and look for the firmware version on the status or system page. Compare it with 3.0.0.6(3948).
2. Check whether the management interface answers from the WAN side. In the router settings, look for remote management or remote web access and confirm it is off.
3. Review port forwards and UPnP mappings for anything that points at the management port.
4. List which accounts and devices can sign in to the interface. The vector needs a low privilege account, so shared or default credentials matter here.

If you manage many devices, keep a table of model, firmware version and location. It turns the next advisory into a lookup.

What to do now

1. Check the Tenda support site for newer firmware for your model and read its notes. No fixed version is confirmed here, so do not assume a patch exists.
2. Turn off remote management and any internet facing access to the device interface.
3. Change default and shared administrator credentials, and use a long unique password.
4. Restrict interface access to a management network or a single admin host where the device allows it.
5. If the device is end of life or no update is offered, plan to replace it. A flaw in the router sits in front of everything behind it.
6. Add the device to your inventory with its firmware version, so the next report is easy to match.

Why it matters

A stack buffer overflow happens when a program copies external input into a fixed size buffer on the stack without checking its length. Extra data overwrites adjacent memory, which can crash the device or, with more effort, change what it executes. On a router or access point that means control of the box that carries your traffic.

The public report describes the data flow at the level of the vulnerable handler. We keep to that level here. The CVE record says an exploit has been disclosed. It does not mark the flaw as a CISA Known Exploited Vulnerability and we found no source reporting active attacks.

Embedded web interfaces are a repeat source of this class of bug because they are written in C with fixed buffers and few checks. The defence you control is exposure: keep management off the internet, keep credentials strong and replace devices that no longer get fixes.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Researcher report on the Tenda W12 flaw
• CVE record and CVSS vector for CVE-2025-11549, published 2025-10-09

Last reviewed: 19 October 2026.