CVE-2025-15215: high-severity vulnerability in Tenda AC10U
Tenda AC10U HTTP POST Request setPptpUserList formSetPPTPUserList buffer overflow
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.7%
A vulnerability was determined in Tenda AC10U 15.03.06.48/15.03.06.49. This affects the function formSetPPTPUserList of the file /goform/setPptpUserList of the component HTTP POST Request Handler. This manipulation of the argument list causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Affected products
Tenda · AC10URelated CVEs — Tenda AC10U
In the same product, most dangerous first.
CVE-2024-0930MEDIUMTenda AC10U fromSetWirelessRepeat stack-based overflowEPSS 15.2%CVE-2024-2707MEDIUMTenda AC10U WriteFacMac formWriteFacMac os command injectionEPSS 4.6%CVE-2024-2853MEDIUMTenda AC10U setsambacfg formSetSambaConf os command injectionEPSS 4.0%CVE-2025-15218HIGHTenda AC10U POST Request Parameter AdvSetLanip fromadvsetlanip buffer overflowEPSS 3.3%CVE-2024-2706HIGHTenda AC10U WifiWpsStart formWifiWpsStart stack-based overflowEPSS 1.7%CVE-2024-2704HIGHTenda AC10U SetFirewallCfg formSetFirewallCfg stack-based overflowEPSS 1.5%