PT-2025-40873 · Tenda · Tenda Ac18

Wxhwxhwxh · Published 2025-09-28 · Updated 2025-10-06 · CVE-2025-11327

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda AC18 version 15.03.05.19(6318)

Description A stack-based buffer overflow exists in the Tenda AC18 device. The issue is located in the /goform/SetUpnpCfg file and involves the manipulation of the upnpEn argument. This allows for remote exploitation of the device. The exploit for this issue has been publicly disclosed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

BDU:2025-13236

CVE-2025-11327

Affected Products

Tenda Ac18

References · 13

• 🔥 https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/SetUpnpCfg.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11327 · Security Note
• https://bdu.fstec.ru/vul/2025-13236 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11327 · Vendor Advisory
• https://t.me/CVEtracker/34222 · Telegram Post
• https://twitter.com/CveFindCom/status/1975119028604551194 · Twitter Post
• https://vuldb.com/?id.327210 · Note
• https://vuldb.com/?ctiid.327210 · Note
• https://vuldb.com/?submit.664532 · Note
• https://tenda.com.cn · Note
• https://t.me/cveNotify/137466 · Telegram Post
• https://twitter.com/CVEnew/status/1975120459910754570 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1975186510715506723 · Twitter Post