CVE-2025-13258
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
Tenda AC20 up to 16.03.08.12 is affected by a buffer overflow in an unknown function of /goform/WifiExtraSet via manipulation of the wpapsk_crypto argument. The attack can be launched remotely and a public exploit exists.
Risk Assessment
A remote attacker could use the public exploit to trigger a buffer overflow, potentially leading to code execution or device crash.
Recommendation
Update the device firmware to the latest version or apply compensating controls if no patch is available.
Other vulnerabilities in Tenda AC20
See all- CVE-2025-14654High
A vulnerability was identified in Tenda AC20 16.03.08.12. The affected element is the function formSetPPTPUserList of the file /goform/setPptpUserList of the component httpd. Manipulation of the argument list leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.
- CVE-2025-11385High
A buffer overflow vulnerability exists in Tenda AC20 up to version 16.03.08.12 in the sscanf function of /goform/fast_setting_wifi_set. Manipulation of the timeZone argument allows remote attacks, and the exploit has been publicly disclosed.
- CVE-2025-10815High
Tenda AC20 up to version 16.03.08.12 has a buffer overflow vulnerability in the strcpy function in the file /goform/SetPptpServerCfg, where the startIp argument can be manipulated. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2025-9791High
A weakness has been identified in Tenda AC20 16.03.08.05. This vulnerability affects unknown code of the file /goform/fromAdvSetMacMtuWan. Manipulation of the wanMTU argument causes a stack-based buffer overflow. Remote exploitation is possible and the exploit has been made public.
Original NVD description (English source)
A vulnerability was detected in Tenda AC20 up to 16.03.08.12. The impacted element is an unknown function of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto results in buffer overflow. The attack can be launched remotely. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS