Details of VAR-202512-0551

ID

VAR-202512-0551

CVE

CVE-2025-14656

TITLE

Shenzhen Tenda Technology Co.,Ltd. of AC20 Buffer error vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-022673

DESCRIPTION

A weakness has been identified in Tenda AC20 16.03.08.12. This affects the function httpd of the file /goform/openSchedWifi. Executing a manipulation of the argument schedStartTime/schedEndTime can lead to buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. Shenzhen Tenda Technology Co.,Ltd. of AC20 The firmware contains a buffer error vulnerability and a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2025-14656 // JVNDB: JVNDB-2025-022673

AFFECTED PRODUCTS

vendor:	tenda	model:	ac20	scope:	eq	version:	16.03.08.12	Trust: 1.0
vendor:	tenda	model:	ac20	scope:	-	version:	-	Trust: 0.8
vendor:	tenda	model:	ac20	scope:	eq	version:	ac20 firmware 16.03.08.12	Trust: 0.8
vendor:	tenda	model:	ac20	scope:	eq	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2025-022673 // NVD: CVE-2025-14656

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com:	CVE-2025-14656
value:	HIGH
Trust: 1.0
OTHER:	JVNDB-2025-022673
value:	HIGH
Trust: 0.8

cna@vuldb.com:	CVE-2025-14656
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
OTHER:	JVNDB-2025-022673
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8

cna@vuldb.com:	CVE-2025-14656
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2025-022673
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2025-022673 // NVD: CVE-2025-14656

PROBLEMTYPE DATA

problemtype:	CWE-119	Trust: 1.0
problemtype:	CWE-120	Trust: 1.0
problemtype:	Buffer error (CWE-119) [ others ]	Trust: 0.8
problemtype:	Classic buffer overflow (CWE-120) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2025-022673 // NVD: CVE-2025-14656

EXTERNAL IDS

db:	NVD	id:	CVE-2025-14656	Trust: 2.6
db:	VULDB	id:	336389	Trust: 1.8
db:	JVNDB	id:	JVNDB-2025-022673	Trust: 0.8

sources: JVNDB: JVNDB-2025-022673 // NVD: CVE-2025-14656

REFERENCES

url:	https://github.com/madgeaaaaa/my_vuln_2/blob/main/tenda/vuln14/ac20_openschedwifi.md	Trust: 1.8
url:	https://vuldb.com/?id.336389	Trust: 1.8
url:	https://vuldb.com/?submit.712917	Trust: 1.8
url:	https://www.tenda.com.cn/	Trust: 1.8
url:	https://vuldb.com/?ctiid.336389	Trust: 1.0
url:	https://nvd.nist.gov/vuln/detail/cve-2025-14656	Trust: 0.8

sources: JVNDB: JVNDB-2025-022673 // NVD: CVE-2025-14656

SOURCES

db:	JVNDB	id:	JVNDB-2025-022673
db:	NVD	id:	CVE-2025-14656

LAST UPDATE DATE

2026-02-24T23:47:32.343000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2025-022673	date:	2025-12-23T02:57:00
db:	NVD	id:	CVE-2025-14656	date:	2026-02-24T06:16:24.803

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2025-022673	date:	2025-12-23T00:00:00
db:	NVD	id:	CVE-2025-14656	date:	2025-12-14T11:15:40.720