CVE-2025-24322: High Auth Flaw in Tenda AC6 Router

CVE-2025-24322 is a high severity unsafe default authentication flaw (CVSS 8.1) in the Tenda AC6 V5.0 router, firmware V02.03.01.110, in its initial setup authentication. The record says a crafted network request can lead to code execution and lists no fixed version. Check Tenda for firmware and restrict admin access.

What's affected

The NVD record names the Tenda AC6 V5.0, firmware V02.03.01.110. The affected feature is the Initial Setup Authentication function. The description calls it an unsafe default authentication vulnerability, and says a specially crafted network request can lead to arbitrary code execution.

The vector shows high attack complexity, which is part of why the score stops at 8.1 and not higher. The record was published on 2025-08-20 and lists a Cisco Talos report, TALOS-2025-2163, as its reference. I could not retrieve that report, so details beyond the record are not repeated here.

The record is not on the CISA Known Exploited Vulnerabilities list.

The weakness is classed as CWE-304 (missing critical step in authentication). The score is 8.1 (HIGH). The vector, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, reads as reachable over the network, high attack complexity, no privileges required and no user interaction. Impact is high on confidentiality, high on integrity and high on availability. The record was published on 2025-08-20.

The record names no fixed firmware. Check the Tenda support page for the AC6 V5.0 and read its release notes, and compare the Talos report for any vendor response it records.

How to check if you're exposed

This is consumer and small office hardware, so the check is manual.

1. Confirm the model and hardware revision on the label, and look for AC6 with version V5.0.
2. Open the admin page and read the firmware version under system status. The listed version is V02.03.01.110.
3. Check that the admin interface is not exposed to the internet, and that remote management and port forwarding to the router are off.
4. Check whether the router is still in its factory state or setup mode, since the weakness sits in initial setup authentication.

If you cannot confirm the version, treat the device as affected.

What to do now

1. Find every Tenda AC6 and record its hardware revision and firmware version.
2. Look for newer firmware on the Tenda site and install it if it is available.
3. Complete setup, set a strong unique admin password and turn off remote management.
4. Keep the router's admin interface reachable only from a trusted wired machine where you can.
5. If no fixed firmware exists, plan a replacement and note it in your asset list.

Why it matters

Unsafe default authentication, classed as CWE-304, means the device ships with a login or setup process that does not properly confirm who is calling. If that gap sits in a feature that runs at start up or during setup, it may remain open on devices people never reconfigured.

A router is a bad place for this. It controls traffic for everything behind it, so code execution on the device is a strong position for an attacker. The high attack complexity in the vector suggests the request is not trivial to craft, which helps, but it does not make the issue go away.

If you track many applications, the free in-browser dependency scan at gold.safeguard.sh/scan can show which of your components have known CVEs, and the Gold directory lists each one with its fix status.

Quick check

Sources

• Safeguard Gold entry for CVE-2025-24322
• NVD record data for CVE-2025-24322 (published 2025-08-20)
• Cisco Talos report TALOS-2025-2163 (listed in the record, not retrieved)

Last reviewed: 19 October 2026.