CVE-2025-57296: Command Injection
Tenda AC6 router firmware 15.03.05.19 contains a command injection vulnerability in the formSetIptv function, which processes requests to the /goform/SetIPTVCfg web interface. When handling the list and vlanId parameters, the subADBC0 helper function concatenates these user-supplied values into nvram set system commands using doSystemCmd, without validating or sanitizing special characters (e.g., ;, ", #). An unauthenticated or authenticated attacker can exploit this by submitting a crafted POST request, leading to arbitrary system command execution on the affected device.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57296?
CVE-2025-57296 has been classified with a high severity due to its potential impact on the security of the Tenda AC6 router.
How do I fix CVE-2025-57296?
To fix CVE-2025-57296, users should update their Tenda AC6 router firmware to the latest version provided by Tenda.
What kind of vulnerability is CVE-2025-57296?
CVE-2025-57296 is a command injection vulnerability in the formSetIptv function of the Tenda AC6 router firmware.
Which devices are affected by CVE-2025-57296?
CVE-2025-57296 affects Tenda AC6 routers running firmware version 15.03.05.19.
What risk does CVE-2025-57296 pose?
CVE-2025-57296 poses a risk of unauthorized command execution on the affected Tenda AC6 routers, potentially allowing attackers to gain control.