PT-2025-47105 · Tenda · Tenda Ac20

Yun Zhang · Published 2025-11-16 · Updated 2025-11-22 · CVE-2025-13258

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda AC20 versions up to 16.03.08.12

Description A buffer overflow exists in the Tenda AC20 router. The issue is located in an unknown function within the /goform/WifiExtraSet file. Manipulation of the wpapsk crypto argument can trigger the overflow, allowing for remote code execution. The exploit for this issue is publicly available.

Recommendations Versions up to 16.03.08.12 should be updated to a newer, secure version as soon as possible. As a temporary workaround, restrict access to the /goform/WifiExtraSet endpoint to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

BDU:2026-00089

CVE-2025-13258

Affected Products

Tenda Ac20

References · 19

• 🔥 https://github.com/DavCloudz/cve/blob/main/Tenda/Tengda%20AC20%20Router%20WifiExtraSet%20Buffer%20Overflow%20Vulnerability.md#poc · Exploit
• 🔥 https://github.com/DavCloudz/cve/blob/main/Tenda/Tengda%20AC20%20Router%20WifiExtraSet%20Buffer%20Overflow%20Vulnerability.md · Exploit
• https://bdu.fstec.ru/vul/2026-00089 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13258 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13258 · Security Note
• https://t.me/poxek/5676 · Telegram Post
• https://t.me/cveNotify/142964 · Telegram Post
• https://twitter.com/cracbot/status/1991823963278987663 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1990260027152613827 · Twitter Post
• https://vuldb.com/?submit.688716 · Note
• https://tenda.com.cn · Note
• https://vuldb.com/?id.332593 · Note
• https://vuldb.com/?ctiid.332593 · Note
• https://twitter.com/transilienceai/status/1990261483540779393 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1990260871101026511 · Twitter Post