CVE-2025-5629

Tenda AC10 HTTP SetPptpServerCfg formSetPPTPServer buffer overflow

View on CVE.org
Published Jun 5, 2025 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
A vulnerability, which was classified as critical, was found in Tenda AC10 up to 15.03.06.47. This affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg of the component HTTP Handler. The manipulation of the argument startIp/endIp leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-16953 A vulnerability, which was classified as critical, was found in Tenda AC10 up to 15.03.06.47. This affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg of the component HTTP Handler. The manipulation of the argument startIp/endIp leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
History
Type Values Removed Values Added
First Time appeared Tenda
Tenda ac10
Tenda ac10 Firmware
CPEs cpe:2.3:h:tenda:ac10:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:ac10_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda ac10
Tenda ac10 Firmware
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability, which was classified as critical, was found in Tenda AC10 up to 15.03.06.47. This affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg of the component HTTP Handler. The manipulation of the argument startIp/endIp leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Title Tenda AC10 HTTP SetPptpServerCfg formSetPPTPServer buffer overflow
Weaknesses CWE-119
CWE-120
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jun 5, 2025, 2:09 PM
Reserved
Jun 4, 2025, 11:19 AM

View source JSON

Updated
Jun 5, 2025, 1:19 PM

JSON

Status
Analyzed
Published
Jun 5, 2025, 3:15 AM
Modified
Jun 17, 2026, 9:48 AM

View source JSON

No data.

No data.