CVE-2025-63666
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Tenda AC15 v15.03.05.18_multi issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to access protected resources.
Risk Assessment
An attacker could hijack a user session and gain access to protected device resources, potentially leading to unauthorized configuration changes.
Recommendation
Update Tenda AC15 firmware to the latest version if the vendor provides a fix. Restrict access to the management interface to trusted networks.
Other vulnerabilities in Tenda AC15
See all- CVE-2026-11493Medium
A weakness was identified in Tenda AC15 firmware version 15.03.05.19 in the Samba component. Manipulation of the /etc_ro/smb.conf file leads to weak password requirements. The attack is only possible within the local network, has high complexity, and is difficult to exploit, but the exploit is publicly available.
- CVE-2026-5830High
In Tenda AC15 version 15.03.05.18, the function websGetVar in /goform/SysToolChangePwd is vulnerable to stack-based buffer overflow via manipulation of arguments oldPwd/newPwd/cfmPwd. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2025-11388High
A stack-based buffer overflow vulnerability was identified in Tenda AC15 version 15.03.05.18. Manipulation of the newVersion argument in /goform/setNotUpgrade allows remote attacks, and the exploit is publicly available.
- CVE-2025-11387High
A stack-based buffer overflow vulnerability was determined in Tenda AC15 version 15.03.05.18. Manipulation of the Password argument in /goform/fast_setting_pppoe_set allows remote attacks, and the exploit has been publicly disclosed.
- CVE-2025-11386High
A stack-based buffer overflow vulnerability was found in Tenda AC15 version 15.03.05.18. Manipulation of the ddnsEn argument in /goform/SetDDNSCfg allows remote attacks, and the exploit has been publicly disclosed.
- CVE-2025-55564High
A stack overflow vulnerability exists in the Tenda AC15 router firmware version 15.03.05.19_multi_TD01 in the fromSetIpMacBind function via the list parameter. An attacker can remotely crash the device or potentially execute arbitrary code.
Original NVD description (English source)
Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to access protected resources.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS