CVE-2025-29217
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A stack overflow vulnerability was discovered in the Tenda W18E v2.0 running firmware v16.01.0.11, specifically in the wifiSSID parameter at the /goform/setModules endpoint. Attackers can cause a Denial of Service (DoS) by sending a crafted POST request.
Risk Assessment
This vulnerability allows remote attackers to crash the device, leading to network disruption and loss of service availability for users.
Recommendation
It is recommended to immediately update the Tenda W18E firmware to the latest version if available, or restrict access to the management interface to trusted networks only.
Other vulnerabilities in Tenda W18E
See all- CVE-2025-45343Critical
A vulnerability in Tenda W18E router version 2.0 with firmware 16.01.0.11 allows remote arbitrary code execution. The flaw resides in the account editing functionality within the goform/setmodules route.
- CVE-2026-118238High
The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. The vulnerability can be exploited without authentication if the device is in a factory-reset state.
Original NVD description (English source)
Tenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiSSID parameter at /goform/setModules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS