Details of VAR-202508-2552

ID

VAR-202508-2552

CVE

CVE-2025-57217

TITLE

Shenzhen Tenda Technology Co.,Ltd. of AC10 Stack-based buffer overflow vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-012925

DESCRIPTION

Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the Password parameter in the function R7WebsSecurityHandler. Shenzhen Tenda Technology Co.,Ltd. of AC10 A stack-based buffer overflow vulnerability exists in the firmware.Service operation interruption (DoS) It may be in a state. The Tenda AC10 is a dual-band gigabit wireless router launched by Shenzhen Jixiang Tengda Technology Co., Ltd., primarily for fiber optic users with speeds of 200 Mbps and above. This vulnerability stems from the failure of the Password parameter in the R7WebsSecurityHandler function to properly validate the length of input data. An attacker could exploit this vulnerability to cause a denial of service

Trust: 2.16

sources: NVD: CVE-2025-57217 // JVNDB: JVNDB-2025-012925 // CNVD: CNVD-2025-20141

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-20141

AFFECTED PRODUCTS

vendor:	tenda	model:	ac10	scope:	eq	version:	16.03.10.09_multi_tde01	Trust: 1.0
vendor:	tenda	model:	ac10	scope:	-	version:	-	Trust: 0.8
vendor:	tenda	model:	ac10	scope:	eq	version:	ac10 firmware 16.03.10.09 multi tde01	Trust: 0.8
vendor:	tenda	model:	ac10	scope:	eq	version:	-	Trust: 0.8
vendor:	tenda	model:	ac10 v16.03.10.09 multi tde01	scope:	eq	version:	v4.0	Trust: 0.6

sources: CNVD: CNVD-2025-20141 // JVNDB: JVNDB-2025-012925 // NVD: CVE-2025-57217

CVSS

SEVERITY

CVSSV2

CVSSV3

134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2025-57217
value:	MEDIUM
Trust: 1.0
OTHER:	JVNDB-2025-012925
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2025-20141
value:	MEDIUM
Trust: 0.6

CNVD:	CNVD-2025-20141
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2025-57217
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	LOW
exploitabilityScore:	3.9
impactScore:	1.4
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2025-012925
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	LOW
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2025-20141 // JVNDB: JVNDB-2025-012925 // NVD: CVE-2025-57217

PROBLEMTYPE DATA

problemtype:	CWE-121	Trust: 1.0
problemtype:	Stack-based buffer overflow (CWE-121) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2025-012925 // NVD: CVE-2025-57217

EXTERNAL IDS

db:	NVD	id:	CVE-2025-57217	Trust: 3.2
db:	JVNDB	id:	JVNDB-2025-012925	Trust: 0.8
db:	CNVD	id:	CNVD-2025-20141	Trust: 0.6

sources: CNVD: CNVD-2025-20141 // JVNDB: JVNDB-2025-012925 // NVD: CVE-2025-57217

REFERENCES

url:	https://plaid-knot-11b.notion.site/stack-buffer-overflow-in-login-auth-via-password-parameter-remote-attacker-can-execute-arbitrary-c-23fb3e9cce32800ba969f8b3a9f80bda?source=copy_link	Trust: 2.4
url:	https://nvd.nist.gov/vuln/detail/cve-2025-57217	Trust: 0.8

sources: CNVD: CNVD-2025-20141 // JVNDB: JVNDB-2025-012925 // NVD: CVE-2025-57217

SOURCES

db:	CNVD	id:	CNVD-2025-20141
db:	JVNDB	id:	JVNDB-2025-012925
db:	NVD	id:	CVE-2025-57217

LAST UPDATE DATE

2025-09-07T23:23:52.545000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-20141	date:	2025-09-03T00:00:00
db:	JVNDB	id:	JVNDB-2025-012925	date:	2025-09-04T06:49:00
db:	NVD	id:	CVE-2025-57217	date:	2025-09-03T16:11:31.440

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-20141	date:	2025-09-02T00:00:00
db:	JVNDB	id:	JVNDB-2025-012925	date:	2025-09-04T00:00:00
db:	NVD	id:	CVE-2025-57217	date:	2025-08-28T18:15:32.587