ByteOS Network

NVD Vulnerability Details :

CVE-2025-5848

Analyzed

Source-cna@vuldb.com

Published At-08 Jun, 2025 | 22:15

Updated At-09 Jun, 2025 | 19:04

A vulnerability was found in Tenda AC15 15.03.05.19_multi and classified as critical. Affected by this issue is the function formSetPPTPUserList of the file /goform/setPptpUserList of the component HTTP POST Request Handler. The manipulation of the argument list leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	4.0	7.4	HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Secondary	2.0	9.0	HIGH	AV:N/AC:L/Au:S/C:C/I:C/A:C

CPE Matches

Tenda Technology Co., Ltd.

>>ac15_firmware>>15.03.05.19_multi

cpe:2.3:o:tenda:ac15_firmware:15.03.05.19_multi:*:*:*:*:*:*:*

Tenda Technology Co., Ltd.

>>ac15>>1.0

cpe:2.3:h:tenda:ac15:1.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-119	Primary	cna@vuldb.com
CWE-120	Primary	cna@vuldb.com

References

Hyperlink	Source	Resource
https://candle-throne-f75.notion.site/Tenda-AC15-formSetPPTPUserList-20adf0aa118580d080eacb031b89ddc6	cna@vuldb.com	Exploit Third Party Advisory
https://vuldb.com/?ctiid.311594	cna@vuldb.com	Permissions Required
https://vuldb.com/?id.311594	cna@vuldb.com	Third Party Advisory VDB Entry
https://vuldb.com/?submit.591372	cna@vuldb.com	Third Party Advisory VDB Entry
https://www.tenda.com.cn/	cna@vuldb.com	Product

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History