Sign-up

ID

VAR-202509-0139


CVE

CVE-2025-9791


TITLE

Shenzhen Tenda Technology Co.,Ltd.  of  AC20  Out-of-bounds write vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-013032

DESCRIPTION

A weakness has been identified in Tenda AC20 16.03.08.05. This vulnerability affects unknown code of the file /goform/fromAdvSetMacMtuWan. This manipulation of the argument wanMTU causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. Shenzhen Tenda Technology Co.,Ltd. of AC20 An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability stems from the failure of the wanMTU parameter in the file /goform/fromAdvSetMacMtuWan to properly validate the length of input data. An attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

Trust: 2.16

sources: NVD: CVE-2025-9791 // JVNDB: JVNDB-2025-013032 // CNVD: CNVD-2025-21170

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-21170

AFFECTED PRODUCTS

vendor:tendamodel:ac20scope:eqversion:16.03.08.5

Trust: 1.0

vendor:tendamodel:ac20scope:eqversion: -

Trust: 0.8

vendor:tendamodel:ac20scope:eqversion:ac20 firmware 16.03.08.5

Trust: 0.8

vendor:tendamodel:ac20scope: - version: -

Trust: 0.8

vendor:tendamodel:ac20scope:eqversion:16.03.08.05

Trust: 0.6

sources: CNVD: CNVD-2025-21170 // JVNDB: JVNDB-2025-013032 // NVD: CVE-2025-9791

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2025-9791
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2025-9791
value: CRITICAL

Trust: 1.0

OTHER: JVNDB-2025-013032
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2025-21170
value: HIGH

Trust: 0.6

cna@vuldb.com: CVE-2025-9791
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

OTHER: JVNDB-2025-013032
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2025-21170
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2025-9791
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

nvd@nist.gov: CVE-2025-9791
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: JVNDB-2025-013032
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2025-21170 // JVNDB: JVNDB-2025-013032 // NVD: CVE-2025-9791 // NVD: CVE-2025-9791

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.0

problemtype:CWE-119

Trust: 1.0

problemtype:CWE-121

Trust: 1.0

problemtype:Buffer error (CWE-119) [ others ]

Trust: 0.8

problemtype: Stack-based buffer overflow (CWE-121) [ others ]

Trust: 0.8

problemtype: Out-of-bounds writing (CWE-787) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2025-013032 // NVD: CVE-2025-9791

EXTERNAL IDS

db:NVDid:CVE-2025-9791

Trust: 3.2

db:VULDBid:322106

Trust: 1.8

db:JVNDBid:JVNDB-2025-013032

Trust: 0.8

db:CNVDid:CNVD-2025-21170

Trust: 0.6

sources: CNVD: CNVD-2025-21170 // JVNDB: JVNDB-2025-013032 // NVD: CVE-2025-9791

REFERENCES

url:https://github.com/cpppq43/tenda/blob/main/tenda_ac20_v16.03.08.05.md

Trust: 1.8

url:https://github.com/cpppq43/tenda/blob/main/tenda_ac20_v16.03.08.05.md#poc

Trust: 1.8

url:https://vuldb.com/?id.322106

Trust: 1.8

url:https://vuldb.com/?submit.641088

Trust: 1.8

url:https://www.tenda.com.cn/

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2025-9791

Trust: 1.4

url:https://vuldb.com/?ctiid.322106

Trust: 1.0

sources: CNVD: CNVD-2025-21170 // JVNDB: JVNDB-2025-013032 // NVD: CVE-2025-9791

SOURCES

db:CNVDid:CNVD-2025-21170
db:JVNDBid:JVNDB-2025-013032
db:NVDid:CVE-2025-9791

LAST UPDATE DATE

2025-09-14T23:37:51.222000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-21170date:2025-09-12T00:00:00
db:JVNDBid:JVNDB-2025-013032date:2025-09-05T06:30:00
db:NVDid:CVE-2025-9791date:2025-09-04T16:20:55.250

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-21170date:2025-09-12T00:00:00
db:JVNDBid:JVNDB-2025-013032date:2025-09-05T00:00:00
db:NVDid:CVE-2025-9791date:2025-09-01T19:15:32.160