CVE-2025-9090

Tenda AC20 Telnet Service telnet websFormDefine command injection

CVSS 5.3 MEDIUMEPSS 14.1%CWE-74 CWE-77

A vulnerability was identified in Tenda AC20 16.03.08.12. Affected is the function websFormDefine of the file /goform/telnet of the component Telnet Service. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Productos afectados

Tenda · AC20

PoCs públicas encontradas — 3

githubgithub.com/byteReaper77/CVE-2025-9090★ 1 cve_referencegithub.com/ZZ2266/.github.io/blob/main/AC20/telnet/readme.md#poc-exploit-stepsno verificado exploitdbwww.exploit-db.com/exploits/52418no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://github.com/ZZ2266/.github.io/blob/main/AC20/telnet/readme.md https://github.com/ZZ2266/.github.io/blob/main/AC20/telnet/readme.md#poc-exploit-steps https://vuldb.com/?ctiid.320358 https://vuldb.com/?id.320358 https://vuldb.com/?submit.632232 https://www.tenda.com.cn/