CVE-2025-15216CWE-119CWE-121

CVE-2025-15216

High · published December 30, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
53.9
In the wild
Unconfirmed
What it is

🚨 A simple remote request is all it takes to exploit this Tenda router vulnerability! An attacker can trigger a stack-based buffer overflow just by manipulating a parameter. ⚡ Think of it like a waiter who takes your order but doesn't check the kitchen for any allergies. If they serve up something unexpected and dangerous, it can lead to a big mess—just like how this vulnerability can cause your router to crash or worse! If exploited, an attacker could potentially gain full control over your router, leading to unauthorized access to your network. This could allow them to intercept data, change settings, or even launch attacks on other devices connected to your network. The consequences could be absolutely devastating for your privacy and security.

Put simply

Think of it like a waiter who takes your order but doesn't check the kitchen for any allergies. If they serve up something unexpected and dangerous, it can lead to a big mess—just like how this vulnerability can cause your router to crash or worse! This vulnerability, found in the Tenda AC23 with firmware version 16.03.07.52, allows for a stack-based buffer overflow through improper handling of the bindnum parameter in the SetIpMacBind function, making it exploitable remotely.

What to do

If exploited, an attacker could potentially gain full control over your router, leading to unauthorized access to your network. This could allow them to intercept data, change settings, or even launch attacks on other devices connected to your network. The consequences could be absolutely devastating for your privacy and security. To protect yourself, immediately patch your Tenda AC23 router to the latest firmware version provided by the manufacturer. Additionally, limit remote management access if possible, and audit your network for any unauthorized devices. 🛡️ You've got this! Follow these steps and you'll keep your network secure from this sneaky vulnerability! 💪✨

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00736 · 53.9th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-121 · Stack-based Buffer Overflow
Published
2025-12-30T08:15Z
Affected products (1)
ProductVersionsFixed in
tenda/ac23_firmwareall versions—
References (5)
EPSS history
Timeline
  • 30 DEC 02:32Z
    Tenda AC23 SetIpMacBind fromSetIpMacBind stack-based overflow
    cvelistv5