PT-2025-53850 · Tenda · Tenda M3

Dwbruijn · Published 2025-12-30 · Updated 2026-01-04 · CVE-2025-15231

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda M3 version 1.0.0.13(4903)

Description A flaw exists in the Tenda M3 router that could allow for remote code execution. The issue is due to a stack-based buffer overflow within the formSetRemoteVlanInfo function, located in the /goform/setVlanInfo file. Manipulation of the ID/vlan/port argument can trigger this overflow. The exploit for this issue has been publicly disclosed and may be used to compromise systems remotely.

Recommendations Versions prior to 1.0.0.13(4903) are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

CVE-2025-15231

Affected Products

Tenda M3

References · 13

• 🔥 https://github.com/dwBruijn/CVEs/blob/main/Tenda/setRemoteVlanInfo.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-15231 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15231 · Security Note
• https://twitter.com/cracbot/status/2007769034188878030 · Twitter Post
• https://t.me/CVEtracker/40921 · Telegram Post
• https://vuldb.com/?submit.725493 · Note
• https://twitter.com/VulmonFeeds/status/2005987607977558273 · Twitter Post
• https://t.me/cveNotify/147113 · Telegram Post
• https://tenda.com.cn · Note
• https://twitter.com/CveFindCom/status/2005906485088223743 · Twitter Post
• https://twitter.com/CVEnew/status/2005901741326258685 · Twitter Post
• https://vuldb.com/?ctiid.338627 · Note
• https://vuldb.com/?id.338627 · Note