CVE-2025-11586: High Stack Overflow in Tenda AC7 Router

CVE-2025-11586 is a high severity (CVSS 8.8) stack based buffer overflow in Tenda AC7 firmware 15.03.06.44, in the /goform/setNotUpgrade handler through the newVersion argument. No fixed firmware is confirmed. Turn off remote management, use strong credentials and check Tenda support for an update.

What's affected

• Product: Tenda AC7 router
• Affected firmware: 15.03.06.44
• Weak point: /goform/setNotUpgrade, argument newVersion
• Fixed firmware: none confirmed in the sources reviewed. Check the Tenda support and download pages for your model

The researcher report says a value from the request is stored in configuration and later read back by another routine without a size check. The report says this can cause a crash or possibly remote code execution. Treat the crash as the safe assumption and the code execution as the reason to patch.

The weakness is CWE-121 (stack based buffer overflow) under CWE-119 (improper restriction of operations within the bounds of a memory buffer). The CVSS score is 8.8 (High). The vector calls for a network attack with a low privilege account and no user interaction, and rates confidentiality, integrity and availability impact as high.

How to check if you're exposed

Routers and access points do not use a package manager, so check the firmware version and the network exposure.

1. Sign in to the device web interface from the LAN and look for the firmware version on the status or system page. Compare it with 15.03.06.44.
2. Check whether the management interface answers from the WAN side. In the router settings, look for remote management or remote web access and confirm it is off.
3. Review port forwards and UPnP mappings for anything that points at the management port.
4. List which accounts and devices can sign in to the interface. The vector needs a low privilege account, so shared or default credentials matter here.

If you manage many devices, keep a table of model, firmware version and location. It turns the next advisory into a lookup.

What to do now

1. Check the Tenda support site for newer firmware for your model and read its notes. No fixed version is confirmed here, so do not assume a patch exists.
2. Turn off remote management and any internet facing access to the device interface.
3. Change default and shared administrator credentials, and use a long unique password.
4. Restrict interface access to a management network or a single admin host where the device allows it.
5. If the device is end of life or no update is offered, plan to replace it. A flaw in the router sits in front of everything behind it.
6. Add the device to your inventory with its firmware version, so the next report is easy to match.

Why it matters

A stack buffer overflow happens when a program copies external input into a fixed size buffer on the stack without checking its length. Extra data overwrites adjacent memory, which can crash the device or, with more effort, change what it executes. On a router or access point that means control of the box that carries your traffic.

The public report describes the data flow at the level of the vulnerable handler. We keep to that level here. The CVE record says an exploit has been disclosed. It does not mark the flaw as a CISA Known Exploited Vulnerability and we found no source reporting active attacks.

Embedded web interfaces are a repeat source of this class of bug because they are written in C with fixed buffers and few checks. The defence you control is exposure: keep management off the internet, keep credentials strong and replace devices that no longer get fixes.

Quick check

Sources

• Researcher report on the Tenda AC7 flaw
• CVE record and CVSS vector for CVE-2025-11586, published 2025-10-10

Last reviewed: 19 October 2026.