ID
VAR-202509-1773
CVE
CVE-2025-10815
TITLE
Shenzhen Tenda Technology Co.,Ltd. of AC20 Buffer error vulnerability in firmware
Trust: 0.8
DESCRIPTION
A vulnerability was identified in Tenda AC20 up to 16.03.08.12. Affected by this issue is the function strcpy of the file /goform/SetPptpServerCfg of the component HTTP POST Request Handler. Such manipulation of the argument startIp leads to buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used. Shenzhen Tenda Technology Co.,Ltd. of AC20 The firmware contains a buffer error vulnerability and a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. An attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service
Trust: 2.16
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | tenda | model: | ac20 | scope: | lte | version: | 16.03.08.12 | Trust: 1.0 |
| vendor: | tenda | model: | ac20 | scope: | - | version: | - | Trust: 0.8 |
| vendor: | tenda | model: | ac20 | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | tenda | model: | ac20 | scope: | lte | version: | ac20 firmware 16.03.08.12 and earlier | Trust: 0.8 |
| vendor: | tenda | model: | ac20 | scope: | lte | version: | <=16.03.08.12 | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-120 | Trust: 1.0 |
| problemtype: | CWE-119 | Trust: 1.0 |
| problemtype: | Buffer error (CWE-119) [ others ] | Trust: 0.8 |
| problemtype: | Classic buffer overflow (CWE-120) [ others ] | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2025-10815 | Trust: 3.2 |
| db: | VULDB | id: | 325173 | Trust: 1.8 |
| db: | JVNDB | id: | JVNDB-2025-015043 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2025-24479 | Trust: 0.6 |
REFERENCES
| url: | https://vuldb.com/?id.325173 | Trust: 1.8 |
| url: | https://vuldb.com/?submit.654460 | Trust: 1.8 |
| url: | https://www.tenda.com.cn/ | Trust: 1.8 |
| url: | https://github.com/juana-2u/tenda-ac20 | Trust: 1.6 |
| url: | https://vuldb.com/?ctiid.325173 | Trust: 1.0 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2025-10815 | Trust: 0.8 |
SOURCES
| db: | CNVD | id: | CNVD-2025-24479 |
| db: | JVNDB | id: | JVNDB-2025-015043 |
| db: | NVD | id: | CVE-2025-10815 |
LAST UPDATE DATE
2025-11-19T23:22:21.265000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2025-24479 | date: | 2025-10-22T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-015043 | date: | 2025-10-03T09:22:00 |
| db: | NVD | id: | CVE-2025-10815 | date: | 2025-09-25T18:07:11.053 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2025-24479 | date: | 2025-10-21T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-015043 | date: | 2025-10-03T00:00:00 |
| db: | NVD | id: | CVE-2025-10815 | date: | 2025-09-22T21:15:59.380 |