CVE-2025-5847: falha de alta gravidade em Tenda AC9
Tenda AC9 HTTP POST Request SetRemoteWebCfg formSetSafeWanWebMan stack-based overflow
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 1.0%
A vulnerability has been found in Tenda AC9 15.03.02.13 and classified as critical. Affected by this vulnerability is the function formSetSafeWanWebMan of the file /goform/SetRemoteWebCfg of the component HTTP POST Request Handler. The manipulation of the argument remoteIp leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Produtos afetados
Tenda · AC9CVEs relacionadas — Tenda AC9
No mesmo produto, das mais perigosas para as menos.
CVE-2025-10442MEDIUMTenda AC9/AC15 exeCommand formexeCommand os command injectionEPSS 9.2%CVE-2025-10443HIGHTenda AC9/AC15 exeCommand formexeCommand buffer overflowEPSS 4.6%CVE-2025-5836MEDIUMTenda AC9 POST Request SetIPTVCfg formSetIptv command injectionEPSS 2.8%CVE-2025-5839HIGHTenda AC9 POST Request AdvSetLanip fromadvsetlanip buffer overflowEPSS 1.0%CVE-2026-86300MEDIUMTenda AC9 Web Management R7WebsSecurityHandler improper authenticationEPSS 0.8%CVE-2026-6016HIGHTenda AC9 POST Request WizardHandle decodePwd stack-based overflowEPSS 0.8%