Sign-up

ID

VAR-202506-0293


CVE

CVE-2025-5608


TITLE

Shenzhen Tenda Technology Co.,Ltd.  of  AC18  Buffer error vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-007197

DESCRIPTION

A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formsetreboottimer of the file /goform/SetSysAutoRebbotCfg. The manipulation of the argument rebootTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Shenzhen Tenda Technology Co.,Ltd. of AC18 The firmware contains a buffer error vulnerability and a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Attackers can use this vulnerability to submit special requests and execute arbitrary code

Trust: 2.16

sources: NVD: CVE-2025-5608 // JVNDB: JVNDB-2025-007197 // CNVD: CNVD-2025-12755

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-12755

AFFECTED PRODUCTS

vendor:tendamodel:ac18scope:eqversion:15.03.05.05

Trust: 1.0

vendor:tendamodel:ac18scope:eqversion: -

Trust: 0.8

vendor:tendamodel:ac18scope:eqversion:ac18 firmware 15.03.05.05

Trust: 0.8

vendor:tendamodel:ac18scope: - version: -

Trust: 0.8

vendor:tendamodel:ac18scope:eqversion:v15.03.05.05

Trust: 0.6

sources: CNVD: CNVD-2025-12755 // JVNDB: JVNDB-2025-007197 // NVD: CVE-2025-5608

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2025-5608
value: HIGH

Trust: 1.0

OTHER: JVNDB-2025-007197
value: HIGH

Trust: 0.8

CNVD: CNVD-2025-12755
value: HIGH

Trust: 0.6

cna@vuldb.com: CVE-2025-5608
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

OTHER: JVNDB-2025-007197
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2025-12755
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2025-5608
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

OTHER: JVNDB-2025-007197
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2025-12755 // JVNDB: JVNDB-2025-007197 // NVD: CVE-2025-5608

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.0

problemtype:CWE-120

Trust: 1.0

problemtype:Buffer error (CWE-119) [ others ]

Trust: 0.8

problemtype: Classic buffer overflow (CWE-120) [ others ]

Trust: 0.8

problemtype: Classic buffer overflow (CWE-120) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2025-007197 // NVD: CVE-2025-5608

PATCH

title:Patch for Tenda AC18 buffer overflow vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/698551

Trust: 0.6

sources: CNVD: CNVD-2025-12755

EXTERNAL IDS

db:NVDid:CVE-2025-5608

Trust: 3.2

db:VULDBid:311094

Trust: 1.8

db:JVNDBid:JVNDB-2025-007197

Trust: 0.8

db:CNVDid:CNVD-2025-12755

Trust: 0.6

sources: CNVD: CNVD-2025-12755 // JVNDB: JVNDB-2025-007197 // NVD: CVE-2025-5608

REFERENCES

url:https://lavender-bicycle-a5a.notion.site/tenda-ac18-formsetreboottimer-20653a41781f801ab9e2e022dd089d69?source=copy_link

Trust: 1.8

url:https://vuldb.com/?id.311094

Trust: 1.8

url:https://vuldb.com/?submit.588935

Trust: 1.8

url:https://www.tenda.com.cn/

Trust: 1.8

url:https://vuldb.com/?ctiid.311094

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2025-5608

Trust: 0.8

url:https://lavender-bicycle-a5a.notion.site/tenda-ac18-formsetreboottimer-20653a41781f801ab9e2e022dd089d69

Trust: 0.6

sources: CNVD: CNVD-2025-12755 // JVNDB: JVNDB-2025-007197 // NVD: CVE-2025-5608

SOURCES

db:CNVDid:CNVD-2025-12755
db:JVNDBid:JVNDB-2025-007197
db:NVDid:CVE-2025-5608

LAST UPDATE DATE

2025-06-20T23:05:15.979000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-12755date:2025-06-18T00:00:00
db:JVNDBid:JVNDB-2025-007197date:2025-06-18T02:13:00
db:NVDid:CVE-2025-5608date:2025-06-17T20:41:00.403

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-12755date:2025-06-16T00:00:00
db:JVNDBid:JVNDB-2025-007197date:2025-06-18T00:00:00
db:NVDid:CVE-2025-5608date:2025-06-04T20:15:24.837