ID
VAR-202510-2145
CVE
CVE-2025-60338
TITLE
Tenda AC6 DhcpListClient function buffer overflow vulnerability
Trust: 0.6
DESCRIPTION
Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the DhcpListClient function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. The Tenda AC6 is a wireless router manufactured by Tenda, a Chinese company. Version 15.03.06.50 of the Tenda AC6 contains a buffer overflow vulnerability. This vulnerability stems from the fact that the `page` parameter in the `DhcpListClient` function fails to properly validate the length of the input data
Trust: 1.44
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | tenda | model: | ac6 | scope: | eq | version: | 15.03.06.50 | Trust: 1.0 |
| vendor: | tenda | model: | ac6 | scope: | eq | version: | v2.015.03.06.50 | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-787 | Trust: 1.0 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2025-60338 | Trust: 1.6 |
| db: | CNVD | id: | CNVD-2025-26959 | Trust: 0.6 |
REFERENCES
| url: | https://github.com/z472421519/binaryaudit/blob/main/poc/bof/tenda/fromdhcplistclient/fromdhcplistclient.md | Trust: 1.0 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2025-60338 | Trust: 0.6 |
SOURCES
| db: | CNVD | id: | CNVD-2025-26959 |
| db: | NVD | id: | CVE-2025-60338 |
LAST UPDATE DATE
2025-11-19T23:27:40.984000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2025-26959 | date: | 2025-11-05T00:00:00 |
| db: | NVD | id: | CVE-2025-60338 | date: | 2025-10-23T17:15:39.503 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2025-26959 | date: | 2025-11-05T00:00:00 |
| db: | NVD | id: | CVE-2025-60338 | date: | 2025-10-22T16:15:45.157 |