Details of VAR-202503-0549

ID

VAR-202503-0549

CVE

CVE-2025-29385

TITLE

Shenzhen Tenda Technology Co.,Ltd. of AC9 Out-of-bounds write vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-002428

DESCRIPTION

In Tenda AC9 v1.0 V15.03.05.14_multi, the cloneType parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code execution. Shenzhen Tenda Technology Co.,Ltd. of AC9 An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Tenda AC9 has a buffer overflow vulnerability. The vulnerability is caused by the cloneType parameter of the formAdvSetMacMtuWan function failing to correctly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

Trust: 2.16

sources: NVD: CVE-2025-29385 // JVNDB: JVNDB-2025-002428 // CNVD: CNVD-2025-08912

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-08912

AFFECTED PRODUCTS

vendor:	tenda	model:	ac9	scope:	eq	version:	15.03.05.14	Trust: 1.0
vendor:	tenda	model:	ac9	scope:	-	version:	-	Trust: 0.8
vendor:	tenda	model:	ac9	scope:	eq	version:	ac9 firmware 15.03.05.14	Trust: 0.8
vendor:	tenda	model:	ac9	scope:	eq	version:	-	Trust: 0.8
vendor:	tenda	model:	ac9	scope:	eq	version:	1.0	Trust: 0.6
vendor:	tenda	model:	ac9 15.03.05.14 multi	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2025-08912 // JVNDB: JVNDB-2025-002428 // NVD: CVE-2025-29385

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2025-29385
value:	CRITICAL
Trust: 1.0
134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2025-29385
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2025-29385
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2025-08912
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2025-08912
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2025-29385
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 2.0
NVD:	CVE-2025-29385
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2025-08912 // JVNDB: JVNDB-2025-002428 // NVD: CVE-2025-29385 // NVD: CVE-2025-29385

PROBLEMTYPE DATA

problemtype:	CWE-787	Trust: 1.0
problemtype:	Out-of-bounds writing (CWE-787) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2025-002428 // NVD: CVE-2025-29385

EXTERNAL IDS

db:	NVD	id:	CVE-2025-29385	Trust: 3.2
db:	JVNDB	id:	JVNDB-2025-002428	Trust: 0.8
db:	CNVD	id:	CNVD-2025-08912	Trust: 0.6

sources: CNVD: CNVD-2025-08912 // JVNDB: JVNDB-2025-002428 // NVD: CVE-2025-29385

REFERENCES

url:	https://github.com/shuqi233/loophole/blob/main/tenda%20ac9/advsetmacmtuwan3.md	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2025-29385	Trust: 1.4

sources: CNVD: CNVD-2025-08912 // JVNDB: JVNDB-2025-002428 // NVD: CVE-2025-29385

SOURCES

db:	CNVD	id:	CNVD-2025-08912
db:	JVNDB	id:	JVNDB-2025-002428
db:	NVD	id:	CVE-2025-29385

LAST UPDATE DATE

2025-05-01T23:31:17.713000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-08912	date:	2025-04-30T00:00:00
db:	JVNDB	id:	JVNDB-2025-002428	date:	2025-03-18T07:46:00
db:	NVD	id:	CVE-2025-29385	date:	2025-03-19T19:15:49.280

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-08912	date:	2025-04-28T00:00:00
db:	JVNDB	id:	JVNDB-2025-002428	date:	2025-03-18T00:00:00
db:	NVD	id:	CVE-2025-29385	date:	2025-03-14T17:15:52.393