Details of VAR-202503-0655

ID

VAR-202503-0655

CVE

CVE-2025-29386

TITLE

Shenzhen Tenda Technology Co.,Ltd. of AC9 Out-of-bounds write vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-002441

DESCRIPTION

In Tenda AC9 v1.0 V15.03.05.14_multi, the mac parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code execution. Shenzhen Tenda Technology Co.,Ltd. of AC9 An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Tenda AC9 formAdvSetMacMtuWan has a buffer overflow vulnerability. The vulnerability is caused by the mac parameter of the formAdvSetMacMtuWan function failing to correctly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

Trust: 2.16

sources: NVD: CVE-2025-29386 // JVNDB: JVNDB-2025-002441 // CNVD: CNVD-2025-08795

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-08795

AFFECTED PRODUCTS

vendor:	tenda	model:	ac9	scope:	eq	version:	15.03.05.14	Trust: 1.0
vendor:	tenda	model:	ac9	scope:	eq	version:	ac9 firmware 15.03.05.14	Trust: 0.8
vendor:	tenda	model:	ac9	scope:	-	version:	-	Trust: 0.8
vendor:	tenda	model:	ac9	scope:	eq	version:	-	Trust: 0.8
vendor:	tenda	model:	ac9	scope:	eq	version:	1.0	Trust: 0.6
vendor:	tenda	model:	ac9 15.03.05.14 multi	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2025-08795 // JVNDB: JVNDB-2025-002441 // NVD: CVE-2025-29386

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2025-29386
value:	CRITICAL
Trust: 1.0
134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2025-29386
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2025-29386
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2025-08795
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2025-08795
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2025-29386
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 2.0
NVD:	CVE-2025-29386
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2025-08795 // JVNDB: JVNDB-2025-002441 // NVD: CVE-2025-29386 // NVD: CVE-2025-29386

PROBLEMTYPE DATA

problemtype:	CWE-787	Trust: 1.0
problemtype:	Out-of-bounds writing (CWE-787) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2025-002441 // NVD: CVE-2025-29386

EXTERNAL IDS

db:	NVD	id:	CVE-2025-29386	Trust: 3.2
db:	JVNDB	id:	JVNDB-2025-002441	Trust: 0.8
db:	CNVD	id:	CNVD-2025-08795	Trust: 0.6

sources: CNVD: CNVD-2025-08795 // JVNDB: JVNDB-2025-002441 // NVD: CVE-2025-29386

REFERENCES

url:	https://github.com/shuqi233/loophole/blob/main/tenda%20ac9/advsetmacmtuwan4.md	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2025-29386	Trust: 1.4

sources: CNVD: CNVD-2025-08795 // JVNDB: JVNDB-2025-002441 // NVD: CVE-2025-29386

SOURCES

db:	CNVD	id:	CNVD-2025-08795
db:	JVNDB	id:	JVNDB-2025-002441
db:	NVD	id:	CVE-2025-29386

LAST UPDATE DATE

2025-04-30T23:07:00.663000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-08795	date:	2025-04-29T00:00:00
db:	JVNDB	id:	JVNDB-2025-002441	date:	2025-03-19T01:31:00
db:	NVD	id:	CVE-2025-29386	date:	2025-03-19T19:15:49.423

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-08795	date:	2025-04-25T00:00:00
db:	JVNDB	id:	JVNDB-2025-002441	date:	2025-03-19T00:00:00
db:	NVD	id:	CVE-2025-29386	date:	2025-03-14T17:15:52.557