CVE-2025-0349 is a high severity (8.8) stack-based buffer overflow in the Tenda AC6 router, firmware 15.03.05.16, in the GetParentControlInfo handler. The record lists no fixed firmware. Restrict access to the admin interface and check Tenda's support site for newer firmware.
What's affected
The record names the Tenda AC6 and its firmware, version 15.03.05.16. The affected function is GetParentControlInfo, served at /goform/GetParentControlInfo, and the vulnerable input is the src and mac argument. The record also says other parameters might be affected.
The weakness is listed under CWE-119, CWE-121 and CWE-787. Together they describe memory being written past the end of a buffer on the stack, which can corrupt the program and, in the worst case, let someone take control of it.
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: reachable over the network, low complexity, and it needs low privileges, which on a router usually means a valid login to the admin interface. Impact is high across confidentiality, integrity and availability. The record says the exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
No reference in the record names a fixed firmware version, and I did not find one to confirm. The vendor's support pages are where to look, so check them before you assume an update exists.
How to check if you're exposed
Log in to the router's admin page and find the firmware version in the system or status section. If it reads 15.03.05.16 on a Tenda AC6, your device matches the record.
Then ask who can reach the admin page. Two questions matter. Is remote management turned on, so the interface answers from the internet? And can guests or untrusted devices on your network reach it? From a machine outside your network, test whether the router's public address answers on its web admin port. If it does, close that first.
For organisations that manage many small devices, add routers to an asset list with model and firmware, so a record like this one maps to a list you can read.
What to do now
- Identify every Tenda AC6 you own or manage, including ones at small offices and remote sites.
- Turn off remote administration, and make sure the admin interface is reachable only from a trusted wired segment.
- Change the admin password to a long unique one, since the record's vector assumes a login. Do not reuse a password from elsewhere.
- Check Tenda's support site for firmware newer than 15.03.05.16 and read its release notes. Apply it if one is offered, after backing up your settings.
- If no fix exists and the device sits in a sensitive place, plan to replace it with a model that receives updates.
- Record the model and firmware in your asset list and recheck it when the vendor posts news.
Why it matters
Router firmware is written in memory-unsafe languages and often parses web form input with fixed size buffers. If the code copies a value into a stack buffer without checking its length, extra data spills onto neighbouring memory. That is the class of flaw described here. Fixes are usually small, a length check or a safer copy, but they only help if the vendor ships firmware and owners install it.
Embedded devices tend to be forgotten. They run for years, are rarely patched, and sit at the edge of a network. A public disclosure with no fix listed means exposure reduction does the work: take the interface off the internet and limit who can log in.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this need a login?
The vector says low privileges are required. On a router that usually means an authenticated admin session, so a strong password and no remote management reduce the risk a great deal.
Is there a fixed firmware?
The record names none. Check the vendor support site and release notes before relying on any claim of a patch.
Sources
Last reviewed: 19 October 2026.
