CVE-2025-57639: OS Command Injection

Published Sep 23, 2025

Updated

OS Command injection vulnerability in Tenda AC9 1.0 was discovered to contain a command injection vulnerability via the usb.samba.guest.user parameter in the formSetSambaConf function of the httpd file.

Affected Software

3 affected components

Tenda Ac9

All of the following

Tenda Ac9 Firmware=1.0

Tenda Ac9

Event History

Sep 23, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-57639?

CVE-2025-57639 is classified as a critical severity vulnerability due to the potential for OS command injection that could allow attackers to execute arbitrary commands.

How do I fix CVE-2025-57639?

To fix CVE-2025-57639, it is recommended to update the Tenda AC9 router to the latest firmware version that includes a patch for this vulnerability.

What devices are affected by CVE-2025-57639?

CVE-2025-57639 affects the Tenda AC9 router running firmware version 1.0.

What type of vulnerability is CVE-2025-57639?

CVE-2025-57639 is an OS command injection vulnerability that can be exploited through a specific parameter in the router's configuration.

Can CVE-2025-57639 lead to unauthorized access?

Yes, CVE-2025-57639 can lead to unauthorized access as it allows an attacker to execute commands on the device's operating system.