CVE-2025-10443 HIGH

CVE-2025-10443: Tenda AC9/AC15 exeCommand formexeCommand buffer overflow

Vendor Tenda
Product AC9
Weakness CWE-120
Published September 15, 2025
Last update September 15, 2025

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was identified in Tenda AC9 and AC15 15.03.05.14/15.03.05.18. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Such manipulation of the argument cmdinput leads to buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.

Key dates

02Disclosure timeline

September 15, 2025 CVE published
September 15, 2025 Record updated