CVE-2025-10442

MediumCVSS 6.3

Published: 15/09/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

8.73%

95th percentile - higher than 95% of all known CVEs

Summary

A vulnerability was found in Tenda AC9 and AC15 version 15.03.05.14 affecting the formexeCommand function in /goform/exeCommand. Manipulating the cmdinput argument leads to OS command injection. The flaw can be exploited remotely and a public exploit is available.

Risk Assessment

A remote attacker can execute arbitrary commands on the device, taking full control of it. Since the exploit is public, the risk of rapid exploitation is high.

Recommendation

Update the device firmware to the vendor-fixed version or restrict access to the management interface. If no fix is available, consider removing the device from network exposure.

Other vulnerabilities in Tenda AC9/AC15

CVE-2025-10443High
Tenda AC9 and AC15 15.03.05.14/15.03.05.18 have a vulnerability in the formexeCommand function of /goform/exeCommand. Manipulation of the cmdinput argument leads to a buffer overflow, and the attack can be executed remotely. The exploit is publicly available and might be used.

Original NVD description (English source)

A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14. This affects the function formexeCommand of the file /goform/exeCommand. This manipulation of the argument cmdinput causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS