CVE-2025-10815: Tenda AC20 HTTP POST Request SetPptpServerCfg strcpy buffer overflow
A vulnerability was identified in Tenda AC20 up to 16.03.08.12. Affected by this issue is the function strcpy of the file /goform/SetPptpServerCfg of the component HTTP POST Request Handler. Such manipulation of the argument startIp leads to buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10815?
CVE-2025-10815 has a high severity level due to its potential for remote code execution stemming from a buffer overflow.
How do I fix CVE-2025-10815?
To fix CVE-2025-10815, update the Tenda AC20 firmware to the latest version beyond 16.03.08.12.
What are the potential impacts of CVE-2025-10815?
The potential impacts of CVE-2025-10815 include unauthorized access and control over the device, which can lead to further exploitation.
Which devices are affected by CVE-2025-10815?
CVE-2025-10815 specifically affects the Tenda AC20 device when running firmware version 16.03.08.12 or earlier.
Is CVE-2025-10815 exploitable remotely?
Yes, CVE-2025-10815 can be exploited remotely through manipulated HTTP POST requests, allowing attackers to execute arbitrary code.