CVE-2025-5608: high-severity vulnerability in Tenda AC18
Tenda AC18 SetSysAutoRebbotCfg formsetreboottimer buffer overflow
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 1.1%
A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formsetreboottimer of the file /goform/SetSysAutoRebbotCfg. The manipulation of the argument rebootTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Tenda · AC18Related CVEs — Tenda AC18
In the same product, most dangerous first.
CVE-2025-0528HIGHTenda AC8/AC10/AC18 HTTP Request telnet command injectionEPSS 6.2%CVE-2024-2854MEDIUMTenda AC18 setsambacfg formSetSambaConf os command injectionEPSS 3.9%CVE-2025-5606MEDIUMTenda AC18 SetIPTVCfg formSetIptv command injectionEPSS 3.8%CVE-2025-11121MEDIUMTenda AC18 AdvSetLanip command injectionEPSS 3.5%CVE-2024-2485HIGHTenda AC18 SetSpeedWan formSetSpeedWan stack-based overflowEPSS 1.7%CVE-2024-2490HIGHTenda AC18 openSchedWifi setSchedWifi stack-based overflowEPSS 1.6%