CVE-2025-29384: Critical Critical Stack Overflow in Tenda AC9 wanMTU

CVE-2025-29384 is a critical (CVSS 9.8) stack overflow in the wanMTU parameter of /goform/AdvSetMacMtuWan on the Tenda AC9 router, v1.0 firmware V15.03.05.14_multi. The record says it can lead to remote code execution and names no fix, so check Tenda's support page and limit access to the router.

What's affected

The record says Tenda AC9 v1.0 V15.03.05.14_multi is affected, and lists both the AC9 hardware and its firmware as products. The stack overflow is in the wanMTU parameter of /goform/AdvSetMacMtuWan, the page that handles MAC address and MTU settings for the WAN connection. The same endpoint carries sibling flaws, CVE-2025-29384, CVE-2025-29385 and CVE-2025-29386, one per parameter.

The record names no fixed firmware. The only reference is a researcher's write-up, not a vendor advisory, so check Tenda's support and download pages for a newer firmware for the AC9 and read its release notes before assuming a fix exists.

Severity in the record: critical, CVSS 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Weakness classes: CWE-787 (Out-of-bounds write).

How to check if you're exposed

Read the firmware version in the router's web administration page, normally under system status or about, and compare it with v1.0 V15.03.05.14_multi. The version string in the record is the exact build tested.

Then check exposure:

1. Find out whether remote management is turned on in the router settings. If it is, the administration interface may be reachable from the internet.
2. From outside your network, test whether the router's web port answers, using a tool you are allowed to use on your own address.
3. List every AC9 you manage, including the ones in branch offices, homes of remote staff and storage rooms. Consumer routers are easy to forget.

For home and small office routers there is no package manager, so the inventory is the work.

What to do now

1. Check Tenda's support site for firmware newer than v1.0 V15.03.05.14_multi for the AC9, and install it if it exists.
2. Turn off remote administration and make sure the web interface is reachable only from the local network.
3. Change the administrator password to a strong unique one, and change the Wi-Fi passphrase.
4. Turn off features you do not use, such as WPS, since a smaller feature set means fewer functions that parse input.
5. Put the router's management interface on a network that guest and IoT devices cannot reach.
6. If you cannot get a fixed firmware and the router is used in a business setting, plan to replace it with a model that has a maintained firmware.

Why it matters

CWE-787 is an out-of-bounds write: the program copies more data into a buffer than the buffer can hold and overwrites the memory next to it. On embedded devices such as routers the web server is often a single program that runs as the administrator and has few of the protections that desktop systems have, so an overwrite can become command execution. The record says this one can lead to remote arbitrary code execution.

The score is 9.8 because the vector is a network attack, with low complexity, no privileges and no user action, and high impact on all three properties. Treat the score with some care. The record cites a researcher's report and not a vendor advisory, and does not confirm how the endpoint is reached without a login. Even so, a router sits at the edge of the network, and a flaw of this kind in a device with no patch is a good reason to limit who can reach the interface and to replace unmaintained hardware.

The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.

Quick check

Sources

• Researcher's report
• Safeguard Gold entry for CVE-2025-29384

Last reviewed: 19 October 2026.