Sign-up

ID

VAR-202506-0379


CVE

CVE-2025-5836


TITLE

Shenzhen Tenda Technology Co.,Ltd.  of  AC9  Injection Vulnerability in Firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-006541

DESCRIPTION

A vulnerability was found in Tenda AC9 15.03.02.13. It has been rated as critical. This issue affects the function formSetIptv of the file /goform/SetIPTVCfg of the component POST Request Handler. The manipulation of the argument list leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. of AC9 The firmware contains injection and command injection vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2025-5836 // JVNDB: JVNDB-2025-006541

AFFECTED PRODUCTS

vendor:tendamodel:ac9scope:eqversion:15.03.2.13

Trust: 1.0

vendor:tendamodel:ac9scope: - version: -

Trust: 0.8

vendor:tendamodel:ac9scope:eqversion:ac9 firmware 15.03.2.13

Trust: 0.8

vendor:tendamodel:ac9scope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2025-006541 // NVD: CVE-2025-5836

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2025-5836
value: LOW

Trust: 1.0

OTHER: JVNDB-2025-006541
value: MEDIUM

Trust: 0.8

cna@vuldb.com: CVE-2025-5836
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

OTHER: JVNDB-2025-006541
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

cna@vuldb.com: CVE-2025-5836
baseSeverity: MEDIUM
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 2.8
impactScore: 3.4
version: 3.1

Trust: 1.0

OTHER: JVNDB-2025-006541
baseSeverity: MEDIUM
baseScore: 6.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2025-006541 // NVD: CVE-2025-5836

PROBLEMTYPE DATA

problemtype:CWE-74

Trust: 1.0

problemtype:CWE-77

Trust: 1.0

problemtype:injection (CWE-74) [ others ]

Trust: 0.8

problemtype: Command injection (CWE-77) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2025-006541 // NVD: CVE-2025-5836

EXTERNAL IDS

db:NVDid:CVE-2025-5836

Trust: 2.6

db:VULDBid:311579

Trust: 1.8

db:JVNDBid:JVNDB-2025-006541

Trust: 0.8

sources: JVNDB: JVNDB-2025-006541 // NVD: CVE-2025-5836

REFERENCES

url:https://candle-throne-f75.notion.site/tenda-ac9-formsetiptv-209df0aa11858061ae2bcbf83918d034

Trust: 1.8

url:https://vuldb.com/?id.311579

Trust: 1.8

url:https://vuldb.com/?submit.591363

Trust: 1.8

url:https://www.tenda.com.cn/

Trust: 1.8

url:https://vuldb.com/?ctiid.311579

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2025-5836

Trust: 0.8

sources: JVNDB: JVNDB-2025-006541 // NVD: CVE-2025-5836

SOURCES

db:JVNDBid:JVNDB-2025-006541
db:NVDid:CVE-2025-5836

LAST UPDATE DATE

2025-06-11T22:53:17.077000+00:00


SOURCES UPDATE DATE

db:JVNDBid:JVNDB-2025-006541date:2025-06-10T01:59:00
db:NVDid:CVE-2025-5836date:2025-06-09T19:07:49.417

SOURCES RELEASE DATE

db:JVNDBid:JVNDB-2025-006541date:2025-06-10T00:00:00
db:NVDid:CVE-2025-5836date:2025-06-07T14:15:22.500