CVE-2025-10442CWE-77CWE-78command-injection

CVE-2025-10442

Medium · published September 15, 2025

CVSS v3.1
6.3
EPSS
9%
Percentile
95.1
In the wild
Unconfirmed
What it is

A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14. This affects the function formexeCommand of the file /goform/exeCommand. This manipulation of the argument cmdinput causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.08725 · 95.1th percentile
Weaknesses
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-09-15T15:15Z
Affected products (2)
ProductVersionsFixed in
tenda/ac9_firmwareall versions—
tenda/ac15_firmwareall versions—
References (7)
https://github.com/2664521593/mycve/blob/main/Tenda/Tenda_AC9_CJ.md · [email protected]https://github.com/2664521593/mycve/blob/main/Tenda/Tenda_AC9_CJ.md#poc · [email protected]https://vuldb.com/?ctiid.323876 · [email protected]https://vuldb.com/?id.323876 · [email protected]https://vuldb.com/?submit.647838 · [email protected]https://vuldb.com/?submit.647839 · [email protected]https://www.tenda.com.cn/ · [email protected]
EPSS history
Timeline
  • 15 SEP 11:02Z
    Tenda AC9/AC15 exeCommand formexeCommand os command injection
    cvelistv5