CVE-2025-5839: Tenda AC9 POST Request AdvSetLanip fromadvsetlanip buffer overflow
Description
A vulnerability, which was classified as critical, has been found in Tenda AC9 15.03.02.13. Affected by this issue is the function fromadvsetlanip of the file /goform/AdvSetLanip of the component POST Request Handler. The manipulation of the argument lanMask leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Eine kritische Schwachstelle wurde in Tenda AC9 15.03.02.13 entdeckt. Dies betrifft die Funktion fromadvsetlanip der Datei /goform/AdvSetLanip der Komponente POST Request Handler. Durch das Manipulieren des Arguments lanMask mit unbekannten Daten kann eine buffer overflow-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung.
Classification
CVE ID: CVE-2025-5839
CVSS Base Severity: HIGH
CVSS Base Score: 8.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
Vendor: Tenda
Product: AC9
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.08% (probability of being exploited)
EPSS Percentile: 24.37% (scored less or equal to compared to others)
EPSS Date: 2025-07-06 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-5839https://vuldb.com/?id.311582
https://vuldb.com/?ctiid.311582
https://vuldb.com/?submit.591369
https://candle-throne-f75.notion.site/Tenda-AC9-fromadvsetlanip-20adf0aa11858027b7c3c2f4e44bb867
https://www.tenda.com.cn/