Vulnerability · Published Jan 9, 2025 · Assigned by VulDB

CVE-2025-0349Tenda AC6 GetParentControlInfo stack-based overflow

High 8.8

In plain English

A high-severity stack buffer overflow in AC6 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.9%top 20.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as critical has been found in Tenda AC6 15.03.05.16. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument src/mac leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

Affected products (as reported)

Vendor	Product	Versions
Tenda	AC6	15.03.05.16

Weakness: CWE-121, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

VDB-290862 | Tenda AC6 GetParentControlInfo stack-based overflow vdb-entry, technical-description
VDB-290862 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #477048 | tenda AC6 V15.03.05.16 Buffer Overflow third-party-advisory
https://github.com/wy876/cve/issues/5 exploit, issue-tracking
https://www.tenda.com.cn/ product