CVE-2025-5852 HIGH

CVE-2025-5852: Tenda AC6 setPptpUserList formSetPPTPUserList buffer overflow

Vendor Tenda

Product AC6

Weakness CWE-120

Published June 9, 2025

Last update June 9, 2025

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability classified as critical has been found in Tenda AC6 15.03.05.16. Affected is the function formSetPPTPUserList of the file /goform/setPptpUserList. The manipulation of the argument list leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

June 9, 2025 CVE published

June 9, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-5852 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/120.html

Related vulnerabilities

04Related CVE

CVE-2022-20873 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities CVE-2021-33035 Buffer overflow from a crafted DBF file CVE-2026-2086 UTT HiPER 810G Management formFireWall strcpy buffer overflow CVE-2025-11444 TOTOLINK N600R HTTP Request cstecgi.cgi setWiFiBasicConfig buffer overflow CVE-2024-43055 Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Camera_Linux