Stack Overflow in Tenda AC9 /goform/AdvSetMacMtuWan

This repository contains a small exploit PoC set for CVE-2025-29384 targeting the Tenda AC9 router web interface. The structure is simple: README.md documents the claimed vulnerability and usage, poc.py is the primary standalone exploit, and tenda_ac9_stack_overflow.rb is a Metasploit-style module adaptation. The Python exploit is the main operational component: it builds a target URL from a supplied IP and the fixed endpoint /goform/AdvSetMacMtuWan, generates randomized oversized wanMTU POST data, and sends it via requests.Session using multiple threads. Its practical capability is service disruption or crash induction; it logs HTTP responses or timeouts that may indicate the target web server has become unresponsive. The Ruby file mirrors the same logic in Metasploit module form, sending a POST request with a randomized wanMTU value to the same endpoint. Despite README claims of potential RCE, neither code file contains shellcode, ROP, command execution, callback logic, or a working code-execution primitive. As implemented, this is an unauthenticated network/web DoS-oriented overflow trigger PoC rather than a full RCE exploit. The main fingerprintable target is the router endpoint /goform/AdvSetMacMtuWan over HTTP on port 80, with default target IP 192.168.0.1.

This repository provides a proof-of-concept (PoC) exploit for CVE-2025-29384, a critical stack-based buffer overflow vulnerability in the Tenda AC9 router (firmware V15.03.05.14_multi). The vulnerability is present in the router's web management interface at the endpoint /goform/AdvSetMacMtuWan, where the 'wanMTU' POST parameter is not properly bounds-checked, allowing remote unauthenticated attackers to crash the web server (DoS) and potentially achieve remote code execution (RCE). The repository contains three files: - README.md: Detailed documentation of the vulnerability, exploitation steps, and usage instructions for both the Python PoC and the Metasploit module. - poc.py: A standalone Python exploit that sends oversized, randomized payloads to the vulnerable endpoint, supporting multithreading and customizable parameters (target IP, payload size, thread count). It demonstrates the DoS condition and is structured for educational use. - tenda_ac9_stack_overflow.rb: A Metasploit module that integrates with the Metasploit Framework, allowing users to exploit the vulnerability via msfconsole. The module sends a large payload to the same endpoint and provides feedback on the result. The main exploit capability is remote, unauthenticated exploitation over the network, targeting the router's HTTP interface. The exploit is operational, providing a working DoS and a framework for further RCE development. The repository is well-structured, with clear separation between documentation, standalone PoC, and framework integration.