CVE-2025-67073

CriticalCVSS 9.8

Published: 17/12/2025(UTC)Updated: 13/10/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.69%

52th percentile - higher than 52% of all known CVEs

Summary

In Tenda AC10V4.0 router version V16.03.10.20, a buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd allows remote attackers to cause denial of service and possibly code execution by sending a post request with a crafted payload (field `serviceName`) to /goform/AdvSetMacMtuWan.

Risk Assessment

The risk includes the possibility of remote code execution on the router, which could lead to device takeover and network security compromise.

Recommendation

It is recommended to update the Tenda AC10V4.0 router firmware to the latest available version if a patch exists, and restrict access to the administrative panel.

Other vulnerabilities in Tenda AC10V4.0

CVE-2025-67074Medium
A buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin/httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution by sending a POST request with a crafted payload (field `serverName`) to /goform/AdvSetMacMtuWan.

Original NVD description (English source)

A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution by sending a post request with a crafted payload (field `serviceName`) to /goform/AdvSetMacMtuWan.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS