CVE-2025-55564
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A stack overflow vulnerability exists in the Tenda AC15 router firmware version 15.03.05.19_multi_TD01 in the fromSetIpMacBind function via the list parameter. An attacker can remotely crash the device or potentially execute arbitrary code.
Risk Assessment
The risk includes potential remote code execution on the router, which could lead to network compromise, traffic interception, or use of the device as an entry point for further attacks.
Recommendation
It is recommended to immediately update the Tenda AC15 firmware to the latest available version if a patch is released. If no update is available, restrict management interface access to trusted networks only.
Other vulnerabilities in Tenda AC15
See all- CVE-2026-11493Medium
A weakness was identified in Tenda AC15 firmware version 15.03.05.19 in the Samba component. Manipulation of the /etc_ro/smb.conf file leads to weak password requirements. The attack is only possible within the local network, has high complexity, and is difficult to exploit, but the exploit is publicly available.
- CVE-2026-5830High
In Tenda AC15 version 15.03.05.18, the function websGetVar in /goform/SysToolChangePwd is vulnerable to stack-based buffer overflow via manipulation of arguments oldPwd/newPwd/cfmPwd. The attack can be executed remotely, and the exploit is publicly available.
Original NVD description (English source)
Tenda AC15 v15.03.05.19_multi_TD01 has a stack overflow via the list parameter in the fromSetIpMacBind function.