CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2025-25675: Tenda AC10 V1.0 V15.03.06.23 has a command injection vulnerablility located in the formexeCommand function. The str variable receives the cmdinput...
Description
Tenda AC10 V1.0 V15.03.06.23 has a command injection vulnerablility located in the formexeCommand function. The str variable receives the cmdinput parameter from a POST request and is later assigned to the cmd_buf variable, which is directly used in the doSystemCmd function, causing an arbitrary command execution.
Classification
CVE ID: CVE-2025-25675
Affected Products
Vendor: n/a
Product: n/a
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.23% (probability of being exploited)
EPSS Percentile: 43.13% (scored less or equal to compared to others)
EPSS Date: 2025-03-21 (when was this score calculated)