PT-2025-46661 · Tenda · Tenda Ac15

Published 2025-11-12 · Updated 2025-11-13 · CVE-2025-63666

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda AC15 version 15.03.05.18 multi

Description The authentication cookie used by the device exposes the account password hash to the client and utilizes a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to execute JavaScript in a victim’s browser can steal the cookie and replay it to gain access to protected resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2025-14647

CVE-2025-63666

Affected Products

Tenda Ac15

References · 7

• 🔥 https://github.com/Remenis/CVE-2025-63666 · Exploit
• https://bdu.fstec.ru/vul/2025-14647 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-63666 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63666 · Vendor Advisory
• https://twitter.com/CVEnew/status/1988820465411060054 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1988754364773572623 · Twitter Post
• http://tenda.com · Note