Sign-up

ID

VAR-202509-3860


CVE

CVE-2025-11120


TITLE

Shenzhen Tenda Technology Co.,Ltd.  of  AC18  Buffer error vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-015569

DESCRIPTION

A weakness has been identified in Tenda AC8 16.03.34.06. The affected element is the function formSetServerConfig of the file /goform/SetServerConfig. Executing manipulation can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. Shenzhen Tenda Technology Co.,Ltd. of AC18 The firmware contains a buffer error vulnerability and a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2025-11120 // JVNDB: JVNDB-2025-015569

AFFECTED PRODUCTS

vendor:tendamodel:ac18scope:eqversion:16.03.34.06

Trust: 1.0

vendor:tendamodel:ac18scope:eqversion:ac18 firmware 16.03.34.06

Trust: 0.8

vendor:tendamodel:ac18scope: - version: -

Trust: 0.8

vendor:tendamodel:ac18scope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2025-015569 // NVD: CVE-2025-11120

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2025-11120
value: HIGH

Trust: 1.0

OTHER: JVNDB-2025-015569
value: HIGH

Trust: 0.8

cna@vuldb.com: CVE-2025-11120
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

OTHER: JVNDB-2025-015569
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

cna@vuldb.com: CVE-2025-11120
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

OTHER: JVNDB-2025-015569
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2025-015569 // NVD: CVE-2025-11120

PROBLEMTYPE DATA

problemtype:CWE-120

Trust: 1.0

problemtype:CWE-119

Trust: 1.0

problemtype:Buffer error (CWE-119) [ others ]

Trust: 0.8

problemtype: Classic buffer overflow (CWE-120) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2025-015569 // NVD: CVE-2025-11120

EXTERNAL IDS

db:NVDid:CVE-2025-11120

Trust: 2.6

db:VULDBid:326201

Trust: 1.8

db:JVNDBid:JVNDB-2025-015569

Trust: 0.8

sources: JVNDB: JVNDB-2025-015569 // NVD: CVE-2025-11120

REFERENCES

url:https://github.com/alc9700jmo/cve/issues/19

Trust: 1.8

url:https://vuldb.com/?id.326201

Trust: 1.8

url:https://vuldb.com/?submit.664065

Trust: 1.8

url:https://www.tenda.com.cn/

Trust: 1.8

url:https://vuldb.com/?ctiid.326201

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2025-11120

Trust: 0.8

sources: JVNDB: JVNDB-2025-015569 // NVD: CVE-2025-11120

SOURCES

db:JVNDBid:JVNDB-2025-015569
db:NVDid:CVE-2025-11120

LAST UPDATE DATE

2025-10-12T23:23:07.748000+00:00


SOURCES UPDATE DATE

db:JVNDBid:JVNDB-2025-015569date:2025-10-09T08:08:00
db:NVDid:CVE-2025-11120date:2025-10-03T13:42:17.047

SOURCES RELEASE DATE

db:JVNDBid:JVNDB-2025-015569date:2025-10-09T00:00:00
db:NVDid:CVE-2025-11120date:2025-09-28T21:15:51.167