PT-2025-21838 · Tenda · Tenda Ac15

Xubeining · Published 2025-05-18 · Updated 2025-05-18 · CVE-2025-4867

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Tenda A15 version 15.13.07.13

Description A vulnerability was found in the function formArpNerworkSet of the file /goform/ArpNerworkSet. The manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Recommendations For Tenda A15 version 15.13.07.13, as a temporary workaround, consider disabling the formArpNerworkSet function until a patch is available. Restrict access to the /goform/ArpNerworkSet endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2025-05881

CVE-2025-4867

Affected Products

Tenda Ac15

References · 14

• 🔥 https://github.com/xubeining/Cve_report/blob/main/Notification%20of%20Denial%20of%20Service%20Vulnerability%20in%20Tenda%20A15%20Router%20(Version%20V15.13.07.13)%20by%20Shenzhen%20Jixiang%20Tenda%20Technology.md · Exploit
• 🔥 https://github.com/xubeining/Cve_report · Exploit
• https://osv.dev/vulnerability/CVE-2025-4867 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4867 · Security Note
• https://bdu.fstec.ru/vul/2025-05881 · Security Note
• https://twitter.com/VulmonFeeds/status/1924036901691879728 · Twitter Post
• https://t.me/cvenotify/122808 · Telegram Post
• https://tenda.com.cn · Note
• https://t.me/latest_high_impact_cve/2405 · Telegram Post
• https://vuldb.com/?submit.575501 · Note
• https://vuldb.com/?ctiid.309409 · Note
• https://t.me/cvetracker/24145 · Telegram Post
• https://vuldb.com/?id.309409 · Note
• https://twitter.com/CVEnew/status/1924022984982851707 · Twitter Post