CVE-2025-0566
Published: 19 January 2025
Description
A vulnerability classified as critical has been found in Tenda AC15 15.13.07.13. This affects the function formSetDevNetName of the file /goform/SetDevNetName. The manipulation of the argument mac leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Security Summary
CVE-2025-0566 is a critical stack-based buffer overflow vulnerability affecting the Tenda AC15 router on firmware version 15.13.07.13. The issue lies in the formSetDevNetName function processed via the /goform/SetDevNetName endpoint, where manipulation of the "mac" argument triggers the overflow. Classified under CWEs-119, CWE-121, and CWE-787, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-01-19.
A remote attacker with low privileges can exploit this vulnerability over the network with low attack complexity and without requiring user interaction. Exploitation leads to high confidentiality, integrity, and availability impacts, potentially enabling arbitrary code execution on the device through the buffer overflow.
Advisories and further details are available via VulDB entries such as https://vuldb.com/?ctiid.292527 and https://vuldb.com/?id.292527, along with the vendor site at https://www.tenda.com.cn/. The exploit has been publicly disclosed and may be actively used.
Details
- CWE(s)