PT-2025-15116 · Tenda · Tenda Ac7

Ch13Hh · Published 2025-04-05 · Updated 2025-05-27 · CVE-2025-3346

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda AC7 version 15.03.06.44

Description The issue is related to a buffer overflow in the /goform/SetPptpServerCfg form, specifically affecting the pptp server start ip and pptp server end ip variables.

Recommendations For Tenda AC7 version 15.03.06.44, as a temporary workaround, consider restricting access to the /goform/SetPptpServerCfg form until a patch is available. Avoid using the pptp server start ip and pptp server end ip variables in the affected form until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

BDU:2025-03955

CVE-2025-3346

Affected Products

Tenda Ac7

References · 17

• 🔥 https://github.com/CH13hh/tmp_store_cc/blob/main/AC7formSetPPTPServer/formSetPPTPServer.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-3346 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03955 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-3346 · Security Note
• https://github.com/CH13hh/tmp_store_cc · Note
• https://twitter.com/CVEnew/status/1909181929527587103 · Twitter Post
• https://twitter.com/dailycve/status/1927410850622541936 · Twitter Post
• https://twitter.com/vuldb/status/1908895106675212619 · Twitter Post
• https://tenda.com.cn · Note
• https://vuldb.com/?ctiid.303560 · Note
• https://vuldb.com/?submit.551927 · Note
• https://twitter.com/ET_Labs/status/1909347800841879608 · Twitter Post
• https://t.me/latest_high_impact_cve/2101 · Telegram Post
• https://vuldb.com/?id.303560 · Note
• https://twitter.com/VulmonFeeds/status/1909202910342176962 · Twitter Post