PT-2025-40977 · Tenda · Tenda Ac15

Yhryhryhr_Tu · Published 2025-09-29 · Updated 2025-10-12 · CVE-2025-11386

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda AC15 version 15.03.05.18

Description A buffer overflow can occur due to the manipulation of the ddnsEn argument within a POST request to the /goform/SetDDNSCfg file. This impacts an unknown function of the POST Parameter Handler component. The issue is remotely exploitable. An exploit has been publicly released.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

BDU:2025-13239

CVE-2025-11386

Affected Products

Tenda Ac15

References · 14

• 🔥 https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC15/SetDDNSCfg.md · Exploit
• https://bdu.fstec.ru/vul/2025-13239 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-11386 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11386 · Vendor Advisory
• https://twitter.com/CVEnew/status/1975510644779556868 · Twitter Post
• https://twitter.com/cracbot/status/1977328448709239170 · Twitter Post
• https://twitter.com/CveFindCom/status/1975511346893443360 · Twitter Post
• https://vuldb.com/?ctiid.327313 · Note
• https://t.me/CVEtracker/34305 · Telegram Post
• https://vuldb.com/?id.327313 · Note
• https://vuldb.com/?submit.664969 · Note
• https://t.me/cveNotify/137620 · Telegram Post
• https://tenda.com.cn · Note
• https://twitter.com/offseq/status/1975509471548858416 · Twitter Post