Sign-up

ID

VAR-202510-0903


CVE

CVE-2025-60661


TITLE

Tenda AC18 cloneType parameter stack buffer overflow vulnerability

Trust: 0.6

sources: CNVD: CNVD-2025-24470

DESCRIPTION

Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the cloneType parameter in the fromAdvSetMacMtuWan function. The Tenda AC18 is a dual-band wireless router launched by Shenzhen Jixiang Tengda Technology Co., Ltd. in July 2016, primarily for villas and large homes. This vulnerability stems from the failure of the cloneType parameter in the fromAdvSetMacMtuWan function to properly validate the length of input data. An attacker could exploit this vulnerability to cause a denial of service

Trust: 1.44

sources: NVD: CVE-2025-60661 // CNVD: CNVD-2025-24470

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-24470

AFFECTED PRODUCTS

vendor:tendamodel:ac18scope:eqversion:15.03.05.19

Trust: 1.6

sources: CNVD: CNVD-2025-24470 // NVD: CVE-2025-60661

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2025-60661
value: MEDIUM

Trust: 1.0

134c704f-9b21-4f2e-91b3-4a467353bcc0: CVE-2025-60661
value: MEDIUM

Trust: 1.0

CNVD: CNVD-2025-24470
value: MEDIUM

Trust: 0.6

CNVD: CNVD-2025-24470
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2025-60661
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.1

Trust: 2.0

sources: CNVD: CNVD-2025-24470 // NVD: CVE-2025-60661 // NVD: CVE-2025-60661

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.0

problemtype:CWE-121

Trust: 1.0

sources: NVD: CVE-2025-60661

EXTERNAL IDS

db:NVDid:CVE-2025-60661

Trust: 1.6

db:CNVDid:CNVD-2025-24470

Trust: 0.6

sources: CNVD: CNVD-2025-24470 // NVD: CVE-2025-60661

REFERENCES

url:https://drive.google.com/file/d/10bqmy1xighobz5d_q8gtwfwhmxsn2gjw/view?usp=sharing

Trust: 1.6

sources: CNVD: CNVD-2025-24470 // NVD: CVE-2025-60661

SOURCES

db:CNVDid:CNVD-2025-24470
db:NVDid:CVE-2025-60661

LAST UPDATE DATE

2025-11-19T23:32:10.327000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-24470date:2025-10-22T00:00:00
db:NVDid:CVE-2025-60661date:2025-10-07T17:30:13.020

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-24470date:2025-10-21T00:00:00
db:NVDid:CVE-2025-60661date:2025-10-02T17:16:08.817