CVE-2025-67074

MediumCVSS 6.5

Published: 17/12/2025(UTC)Updated: 13/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

30th percentile - higher than 30% of all known CVEs

Summary

A buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin/httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution by sending a POST request with a crafted payload (field `serverName`) to /goform/AdvSetMacMtuWan.

Risk Assessment

The vulnerability can lead to denial of service (DoS) or remote code execution, potentially allowing an attacker to take control of the device. Tenda AC10V4.0 devices are commonly used in home and small office networks.

Recommendation

Update the firmware of Tenda AC10V4.0 to the latest version if available. If not, consider replacing the device or isolating it from critical network segments.

Other vulnerabilities in Tenda AC10V4.0

CVE-2025-67073Critical
In Tenda AC10V4.0 router version V16.03.10.20, a buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd allows remote attackers to cause denial of service and possibly code execution by sending a post request with a crafted payload (field `serviceName`) to /goform/AdvSetMacMtuWan.

Original NVD description (English source)

A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution by sending a post request with a crafted payload (field `serverName`) to /goform/AdvSetMacMtuWan.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS