CVE-2025-5608 HIGH

CVE-2025-5608: Tenda AC18 SetSysAutoRebbotCfg formsetreboottimer buffer overflow

Vendor Tenda

Product AC18

Weakness CWE-120

Published June 4, 2025

Last update June 4, 2025

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formsetreboottimer of the file /goform/SetSysAutoRebbotCfg. The manipulation of the argument rebootTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

June 4, 2025 CVE published

June 4, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-5608 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/120.html

Related vulnerabilities

04Related CVE

CVE-2026-2904 UTT HiPER 810G ConfigExceptAli strcpy buffer overflow CVE-2026-9295 Edimax BR-6428NS POST Request formWirelessTbl buffer overflow CVE-2022-20890 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities CVE-2022-50689 Cobian Reflector 0.9.93 RC1 Local Denial of Service via Password Field CVE-2026-30979 iccDEV has a heap-based buffer overflow in CIccCalculatorFunc::InitSelectOp()