CVE-2025-9791 is a high severity (8.8, CVSS 3.1) stack-based buffer overflow in Tenda AC20 firmware 16.03.08.05. The wanMTU parameter of /goform/fromAdvSetMacMtuWan is not length checked. No fixed firmware is confirmed, so restrict access to the admin interface and check Tenda's site.
What's affected
The record lists the Tenda AC20 and its firmware, version 16.03.08.05. The description names the file /goform/fromAdvSetMacMtuWan and the argument wanMTU, and says remote exploitation is possible. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which means network reachable, low complexity, and a low privilege login required, with high impact on confidentiality, integrity and availability.
The researcher write-up we could read describes the cause as a failure to validate the length of the wanMTU input, and says an attacker could run arbitrary code on the device. It rates the issue high risk and lists only AC20_V16.03.08.05 as the affected version.
Fixed versions: none confirmed. The record links no Tenda advisory. The write-up lists no patched firmware either. Check the Tenda support page for your hardware revision.
The record says the exploit has been made public. It is not in the CISA Known Exploited Vulnerabilities catalog, and nothing we read reports exploitation in the wild.
How to check if you're exposed
Open the router's admin page and read the firmware version on the system status screen. If it reads 16.03.08.05 on an AC20, you are in scope.
Then check whether the admin interface is reachable from outside your network. From a device that is not on your LAN, such as a phone on mobile data, try to load the router's public address on its web admin port. If the login page appears, remote management is on and the exposure is real. If nothing loads, an attacker needs a foothold inside your network first.
The vector needs a login, so also check who has the admin password and whether it is still the factory default.
What to do now
- Turn off remote web management on the router unless you truly need it.
- Change the admin password to a long unique one, and make sure guests and untrusted devices are on a separate network.
- Check Tenda's download page for firmware newer than 16.03.08.05 for the AC20 and install it if one exists. Confirm the release notes mention this issue before you rely on it.
- If the device no longer receives updates, plan to replace it. A router with a public, unpatched memory corruption bug is a poor edge device.
- Watch the router's logs and your network for unexpected restarts or new configuration changes.
Why it matters
The weakness classes are CWE-119 (improper restriction of operations within a memory buffer), CWE-121 (stack-based buffer overflow) and CWE-787 (out-of-bounds write). A stack overflow in firmware that runs as a privileged process can give an attacker control of the router, and from there a view of the traffic that passes through it.
Consumer and small office routers are rarely patched on a schedule, which is why a public write-up matters more here than it would for a managed server. Cutting off remote management removes most of the risk while you wait for a fix.
Quick check
Is there fixed firmware for the Tenda AC20?
We could not confirm one. The record and the write-up we read name no patched version, so check Tenda's support page for your exact hardware revision.
Do I need to be logged in to be attacked?
The record's vector says a low privilege account is required. That makes the admin password and remote management settings the first things to harden.
Sources
- Researcher write-up referenced by the record
- VulDB entry listed in the record (the page would not load for us, so nothing here relies on it)
- Gold vulnerability page
- Free in-browser dependency scan
Last reviewed: 18 October 2026.
