CVE-2025-9087 is a High severity (CVSS 8.8) stack-based buffer overflow in Tenda AC20 firmware 16.03.08.12. The set_qosMib_list handler at /goform/SetNetControlList mishandles the list input. No fixed firmware is confirmed in the sources reviewed, so limit access to the admin interface and watch the vendor for an update.
What's affected
The record lists Tenda AC20 version 16.03.08.12. The weak spot is the function set_qosMib_list behind the web endpoint /goform/SetNetControlList, where manipulation of the argument list leads to a stack-based buffer overflow. The record says the attack can be launched remotely and that the exploit has been disclosed to the public and may be used. It scores 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vector shows low privileges are required (PR:L), so an attacker needs a login to the device first, and no user interaction.
The reporter write-up we read names the same firmware and lists no patch or vendor statement. We could not confirm a fixed firmware version, so check the vendor's support and download pages for a release newer than 16.03.08.12 before you rely on any claim that it is fixed.
How to check if you're exposed
There is nothing to query from a package manager here. This is router or access point firmware.
- Log in to the device's admin page and read the firmware version on the status or system page. If it matches 16.03.08.12, treat the device as affected.
- Check whether the admin interface is reachable from the internet. Remote web management should be off unless you truly need it.
- List every device of this model across your sites, including ones in branch offices and home offices that were set up by someone else.
- Look at the router's access logs, if it keeps any, for repeated requests to /goform/SetNetControlList from addresses you do not recognize.
For the software your own teams ship, the free in-browser dependency scan will not see router firmware, but it will tell you about library issues in the apps that sit behind it.
What to do now
- Turn off remote administration on the WAN side and limit the admin page to a trusted management network.
- Change the admin password to a strong unique one. The record's vector suggests an attacker needs valid credentials, so a weak or default password lowers the bar.
- Check the vendor's download page for firmware newer than 16.03.08.12 and read its release notes before you flash it. Back up the configuration first.
- If no update appears, plan a replacement for any device that sits at the edge of a sensitive network. Keep it off the internet in the meantime.
- Segment the device so a compromise cannot reach servers or admin laptops directly.
Why it matters
The weakness class is CWE-119 (improper restriction of operations within a memory buffer) and CWE-121 (stack-based buffer overflow). Stack-based buffer overflows in embedded web handlers are a long-running pattern. A request field is copied into a fixed buffer on the stack without a length check, and the device crashes or worse.
The record does not list this CVE as a CISA Known Exploited Vulnerability, and we found no advisory saying it is exploited. Public disclosure still shortens the time before scanners include a check, and consumer and small office routers are rarely patched quickly.
Quick check
Is there a fixed firmware for CVE-2025-9087?
We could not confirm one. The reporter write-up lists none and the record does not name a fixed version. Check the vendor support page for newer firmware.
Do I need to be logged in to the device?
The record vector says low privileges are required, which normally means a valid login. Do not rely on that alone, since weak passwords are common.
Sources
Last reviewed: 18 October 2026.
