CVE-2025-45042 is a critical command injection flaw (CVSS 9.8) in the Tenda AC9 router on firmware v15.03.05.14. The record ties it to the Telnet function and rates it as network reachable with no login. No fixed version is listed, so close Telnet and remote access and check Tenda for new firmware.
What's affected
Per the CVE record, Tenda AC9 firmware v15.03.05.14 contains a command injection vulnerability in its Telnet function. The affected products are the AC9 and its firmware.
The record gives few details beyond that sentence. It does not name a patched release, and the single reference is a public write up on GitHub that I did not retrieve. Check Tenda's support site for AC9 firmware newer than v15.03.05.14, and read the release notes.
The CVSS vector is network based, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. That adds up to a score of 9.8. The record does not report attacks in the wild, and the KEV flag is false.
How to check if you're exposed
Open the router's admin page and read the firmware version. If it is v15.03.05.14, treat the device as affected.
Then see whether Telnet is reachable. Telnet uses TCP port 23, and a router should not answer on it from user networks, let alone the internet. From a machine on your network, you can test your own router:
nmap -p 23,80,443 <router-address>
Run this only against devices you own. If port 23 is open, find out why. Some firmware turns Telnet on for support or debugging, and some turns it on only after a trigger. Look through the settings pages for any Telnet or remote shell option.
Also check whether the admin interface is exposed through remote management or port forwarding. A scan of your public address from an outside network will show what the internet can reach.
What to do now
- List all Tenda AC9 units, with firmware versions, including those at small sites and home offices.
- Check for a newer firmware on Tenda's site and install it if one is available.
- Turn off remote management and any Telnet option you can find in the settings.
- Block inbound traffic to port 23 and the admin ports at the network edge.
- Keep the router on its own network segment if it shares space with servers or cameras.
- Change the admin password to a long unique one.
- If the vendor ships no fix and the device guards anything important, replace it.
Why it matters
The record maps the issue to CWE-77 and CWE-78. Command injection means input is passed into an operating system command without being made safe, so the router runs what the attacker meant instead of what the developer meant. On a router, commands usually run as root.
Telnet adds a second problem. It is an old remote shell protocol with no encryption, and its presence on a consumer router is a long running source of trouble. A flaw in how that function handles input is a direct path to a shell.
Home and small office gear is easy to forget. It is also the first thing between your staff and the internet. Keep a short list of these devices and review it every quarter.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the software you build. For hardware, the Gold directory helps you look up CVEs by vendor and product.
Quick check
Is CVE-2025-45042 being exploited in the wild?
The record does not report exploitation and its CISA KEV flag is false. That can change, so check the CISA catalog again before you decide how urgent this is.
Does turning off Telnet fix this?
It removes the exposed entry point if the service is truly off, but the record names no patch. Check Tenda for firmware and keep the device off the internet.
Sources
- CVE-2025-45042 on Gold
- NVD record for CVE-2025-45042
- Reference listed in the CVE record: a public GitHub write up for the AC9 Telnet issue. It was not retrieved when this post was written.
Last reviewed: 18 October 2026.
