CVE-2025-15233: Tenda M3 setAdInfoDetail formSetAdInfoDetails heap-based overflow
A security flaw has been discovered in Tenda M3 1.0.0.13(4903). This issue affects the function formSetAdInfoDetails of the file /goform/setAdInfoDetail. The manipulation of the argument adName/smsPassword/smsAccount/weixinAccount/weixinName/smsSignature/adRedirectUrl/adCopyRight/smsContent/adItemUID results in heap-based buffer overflow. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15233?
CVE-2025-15233 has been rated as a high severity vulnerability due to its potential impact on the confidentiality and integrity of the affected system.
How do I fix CVE-2025-15233?
To fix CVE-2025-15233, users should update their Tenda M3 devices to the latest firmware version that addresses this vulnerability.
What are the affected components of CVE-2025-15233?
CVE-2025-15233 specifically affects the 'formSetAdInfoDetails' function in the setAdInfoDetail file of Tenda M3 routers.
What types of attacks can be executed through CVE-2025-15233?
Exploitation of CVE-2025-15233 can lead to potential unauthorized access and manipulation of sensitive settings in the Tenda M3 router.
Is there a workaround for CVE-2025-15233?
Currently, no official workaround has been provided for CVE-2025-15233; updating the firmware is the recommended mitigation.