PT-2025-53836 · Tenda · Tenda Ac10

Yhryhryhr_Miemie

·

Published

2025-12-29

·

Updated

2026-01-04

·

CVE-2025-15215

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Tenda AC10U versions 15.03.06.48 through 15.03.06.49
Description A buffer overflow issue exists in the formSetPPTPUserList function within the HTTP POST Request Handler component, specifically in the /goform/setPptpUserList file of the Tenda AC10U. The issue is triggered by manipulating the argument list, allowing for remote code execution. The vulnerability occurs due to insufficient input validation when processing the list parameter. The exploit for this issue has been publicly disclosed.
Recommendations Versions 15.03.06.48 through 15.03.06.49 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119CWE-120

Related Identifiers

BDU:2025-16477
CVE-2025-15215

Affected Products

Tenda Ac10