← back
CVE-2025-9523

Tenda AC1206 GetParentControlInfo stack-based overflow

CVSS 9.3 CRITICALEPSS 1.0%CWE-119CWE-121
A vulnerability was detected in Tenda AC1206 15.03.06.23. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument mac results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Affected products
Tenda · AC1206
public PoCs found — 1
cve_referencegithub.com/XXRicardo/iot-cve/blob/main/Tenda/AC1206/AC1206V1.0RTL_V15.03.06.23.mdunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/XXRicardo/iot-cve/blob/main/Tenda/AC1206/AC1206V1.0RTL_V15.03.06.23.mdhttps://vuldb.com/?ctiid.321541https://vuldb.com/?id.321541https://vuldb.com/?submit.634309https://www.tenda.com.cn/