CVE-2025-10443
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
Tenda AC9 and AC15 15.03.05.14/15.03.05.18 have a vulnerability in the formexeCommand function of /goform/exeCommand. Manipulation of the cmdinput argument leads to a buffer overflow, and the attack can be executed remotely. The exploit is publicly available and might be used.
Risk Assessment
A remote attacker could exploit the buffer overflow to execute arbitrary code or cause a denial of service. Public availability of the exploit increases the risk.
Recommendation
Update Tenda AC9/AC15 firmware to the latest version if available. Otherwise, restrict management interface access and monitor network traffic.
Other vulnerabilities in Tenda AC9/AC15
Original NVD description (English source)
A vulnerability was identified in Tenda AC9 and AC15 15.03.05.14/15.03.05.18. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Such manipulation of the argument cmdinput leads to buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS