PT-2025-39794 · Tenda · Tenda Ac18

Yhryhryhr_Miemie · Published 2025-09-28 · Updated 2025-09-28 · CVE-2025-11123

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda AC18 version 15.03.05.19

Description A flaw exists in Tenda AC18 version 15.03.05.19. The issue involves a stack-based buffer overflow in an unknown function of the file /goform/saveAutoQos. The enable argument can be manipulated to trigger this overflow. This manipulation can be initiated remotely. An exploit for this issue has been published.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

BDU:2025-12399

CVE-2025-11123

Affected Products

Tenda Ac18

References · 13

• 🔥 https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/saveAutoQos.md · Exploit
• 🔥 https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/saveAutoQos.md#poc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11123 · Security Note
• https://bdu.fstec.ru/vul/2025-12399 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11123 · Vendor Advisory
• https://vuldb.com/?submit.664197 · Note
• https://twitter.com/CveFindCom/status/1972431064401375537 · Twitter Post
• https://t.me/CVEtracker/33596 · Telegram Post
• https://vuldb.com/?id.326204 · Note
• https://tenda.com.cn · Note
• https://t.me/cveNotify/136755 · Telegram Post
• https://twitter.com/CVEnew/status/1972433712605212922 · Twitter Post
• https://vuldb.com/?ctiid.326204 · Note