PT-2025-53853 · Tenda · Tenda M3

Dwbruijn · Published 2025-12-28 · Updated 2026-01-04 · CVE-2025-15233

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda M3 version 1.0.0.13(4903)

Description A security issue exists in Tenda M3 version 1.0.0.13(4903). The formSetAdInfoDetails function within the /goform/setAdInfoDetail file is susceptible to a heap-based buffer overflow. This occurs through the manipulation of the following arguments: adName, smsPassword, smsAccount, weixinAccount, weixinName, smsSignature, adRedirectUrl, adCopyRight, smsContent, and adItemUID. The issue can be exploited remotely. The exploit code for this issue is publicly available.

Recommendations For Tenda M3 version 1.0.0.13(4903), at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Heap Based Buffer Overflow

Buffer Overflow

Weakness Enumeration

CWE-122

CWE-119

Related Identifiers

BDU:2026-00325

CVE-2025-15233

Affected Products

Tenda M3

References · 14

• 🔥 https://github.com/dwBruijn/CVEs/blob/main/Tenda/setAdInfoDetail.md · Exploit
• https://bdu.fstec.ru/vul/2026-00325 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-15233 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15233 · Vendor Advisory
• https://twitter.com/CVEnew/status/2005925061824311510 · Twitter Post
• https://twitter.com/cracbot/status/2007769037695311889 · Twitter Post
• https://t.me/cveNotify/147116 · Telegram Post
• https://twitter.com/CveFindCom/status/2005921577464893503 · Twitter Post
• https://vuldb.com/?id.338629 · Note
• https://vuldb.com/?ctiid.338629 · Note
• https://tenda.com.cn · Note
• https://vuldb.com/?submit.725495 · Note
• https://twitter.com/VulmonFeeds/status/2005982489131540711 · Twitter Post
• https://t.me/CVEtracker/40923 · Telegram Post