Vulnerability · Published Apr 18, 2025 · Assigned by VulDB
CVE-2025-3786Tenda AC15 WifiExtraSet fromSetWirelessRepeat buffer overflow
High 8.8
In plain English
A high-severity buffer overflow in AC15 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.1%top 33.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in Tenda AC15 up to 15.03.05.19 and classified as critical. This issue affects the function fromSetWirelessRepeat of the file /goform/WifiExtraSet. The manipulation of the argument mac leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected products (as reported)
Weakness: CWE-120, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- VDB-305609 | Tenda AC15 WifiExtraSet fromSetWirelessRepeat buffer overflow vdb-entry, technical-description
- VDB-305609 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #553703 | Shenzhen Tenda Technology Co.,Ltd. AC15 <=V15.03.05.19 Buffer Overflow third-party-advisory
- https://github.com/CH13hh/cve/tree/AC15WifiExtraSet exploit
- https://www.tenda.com.cn/ broken-link, product