Tenda · Tenda Ac20 · CVE-2025-15356
**Name of the Vulnerable Software and Affected Versions**
Tenda AC20 versions prior to 16.03.08.12
**Description**
A buffer overflow issue exists in Tenda AC20 routers. The issue is located in the `sscanf` function within the `/goform/PowerSaveSet` file. Manipulation of the `powerSavingEn`, `time`, `powerSaveDelay`, and `ledCloseType` arguments can trigger the overflow. This can be exploited remotely. The exploit has been publicly disclosed.
**Recommendations**
Update Tenda AC20 to a version later than 16.03.08.12. As a temporary workaround, restrict access to the `/goform/PowerSaveSet` file to minimize the risk of exploitation.