CVE-2025-10815
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
Tenda AC20 up to version 16.03.08.12 has a buffer overflow vulnerability in the strcpy function in the file /goform/SetPptpServerCfg, where the startIp argument can be manipulated. The attack can be launched remotely, and the exploit is publicly available.
Risk Assessment
A remote attacker can cause a buffer overflow, potentially leading to device crash or possibly code execution.
Recommendation
Apply available firmware updates or restrict access to the device from trusted networks.
Other vulnerabilities in Tenda AC20
See all- CVE-2025-14654High
A vulnerability was identified in Tenda AC20 16.03.08.12. The affected element is the function formSetPPTPUserList of the file /goform/setPptpUserList of the component httpd. Manipulation of the argument list leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.
- CVE-2025-13258High
Tenda AC20 up to 16.03.08.12 is affected by a buffer overflow in an unknown function of /goform/WifiExtraSet via manipulation of the wpapsk_crypto argument. The attack can be launched remotely and a public exploit exists.
- CVE-2025-11385High
A buffer overflow vulnerability exists in Tenda AC20 up to version 16.03.08.12 in the sscanf function of /goform/fast_setting_wifi_set. Manipulation of the timeZone argument allows remote attacks, and the exploit has been publicly disclosed.
- CVE-2025-9791High
A weakness has been identified in Tenda AC20 16.03.08.05. This vulnerability affects unknown code of the file /goform/fromAdvSetMacMtuWan. Manipulation of the wanMTU argument causes a stack-based buffer overflow. Remote exploitation is possible and the exploit has been made public.
Original NVD description (English source)
A vulnerability was identified in Tenda AC20 up to 16.03.08.12. Affected by this issue is the function strcpy of the file /goform/SetPptpServerCfg of the component HTTP POST Request Handler. Such manipulation of the argument startIp leads to buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS