CVE-2025-25675: Command Injection
Tenda AC10 V1.0 V15.03.06.23 has a command injection vulnerablility located in the formexeCommand function. The str variable receives the cmdinput parameter from a POST request and is later assigned to the cmdbuf variable, which is directly used in the doSystemCmd function, causing an arbitrary command execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-25675?
CVE-2025-25675 is considered a high severity command injection vulnerability.
How do I fix CVE-2025-25675?
To fix CVE-2025-25675, update the Tenda AC10 firmware to the latest version that addresses this vulnerability.
What causes the vulnerability in CVE-2025-25675?
CVE-2025-25675 is caused by improper handling of user input in the formexeCommand function.
Who is affected by CVE-2025-25675?
CVE-2025-25675 affects users of the Tenda AC10 running firmware version V15.03.06.23.
What are the potential impacts of CVE-2025-25675?
The potential impacts of CVE-2025-25675 include unauthorized command execution on the vulnerable device.