CVE-2025-13445CWE-119CWE-121

CVE-2025-13445

High · published November 20, 2025

CVSS v3.1
8.8
EPSS
4%
Percentile
90.9
In the wild
Unconfirmed
What it is

⚡ A sneaky stack-based buffer overflow lurks in the Tenda AC21 device! An attacker can trigger this vulnerability remotely, putting your network at risk. 🔥 Think of it like a delivery driver who can access your entire office space just by manipulating a package label—one tiny change leads to a whole lot of chaos. 📦 If exploited, this flaw can allow an attacker to overflow the stack memory, potentially giving them the ability to execute arbitrary code. This means they could control your device, access sensitive information, or disrupt your entire network. Yikes!

Put simply

Think of it like a delivery driver who can access your entire office space just by manipulating a package label—one tiny change leads to a whole lot of chaos. 📦 The vulnerability in Tenda AC21 arises from improper handling of argument lists in the /goform/SetIpMacBind file, leading to a stack-based buffer overflow that could be exploited remotely.

What to do

If exploited, this flaw can allow an attacker to overflow the stack memory, potentially giving them the ability to execute arbitrary code. This means they could control your device, access sensitive information, or disrupt your entire network. Yikes! To protect yourself, update your Tenda AC21 firmware to the latest version as soon as it’s available. If an immediate fix isn’t ready, consider restricting remote access to the device or monitoring network traffic for suspicious activity. Stay vigilant! You've got this! By taking these steps, you'll ensure your network remains secure and protected! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04209 · 90.9th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-121 · Stack-based Buffer Overflow
Published
2025-11-20T20:17Z
Affected products (1)
ProductVersionsFixed in
tenda/ac21_firmwareall versions—
References (6)
EPSS history
Timeline
  • 20 NOV 02:02Z
    Tenda AC21 SetIpMacBind stack-based overflow
    cvelistv5