CVE-2025-3328highCWE-119CWE-120

CVE-2025-3328: high-severity vulnerability in Tenda AC1206

Tenda AC1206 fast_setting_wifi_set form_fast_setting_wifi_set buffer overflow

Published

Follow this CVE+ Monitor AC1206

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 7.6%
A vulnerability was found in Tenda AC1206 15.03.06.23. It has been classified as critical. Affected is the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set. The manipulation of the argument ssid/timeZone leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Tenda · AC1206
Related CVEs — Tenda AC1206

In the same product, most dangerous first.

CVE-2024-9793MEDIUMTenda AC1206 ate ate_ifconfig_set command injectionEPSS 23.1%CVE-2026-0581MEDIUMTenda AC1206 httpd BehaviorManager formBehaviorManager command injectionEPSS 9.4%CVE-2025-7544HIGHTenda AC1206 setMacFilterCfg formSetMacFilterCfg stack-based overflowEPSS 1.8%CVE-2025-10432CRITICALTenda AC1206 HTTP Request AdvSetMacMtuWa check_param_changed stack-based overflowEPSS 1.6%CVE-2026-82694CRITICALTenda AC1206 Web UI ate R7WebsSecurityHandler missing authenticationEPSS 1.4%CVE-2026-82693CRITICALTenda AC1206 Web UI telnet TendaTelnet missing authenticationEPSS 1.4%