CVE-2025-15218CWE-119CWE-120

CVE-2025-15218

High · published December 30, 2025

CVSS v3.1
8.8
EPSS
3%
Percentile
88.5
In the wild
Unconfirmed
What it is

⚡ A remote attacker can exploit a vulnerability in Tenda AC10U routers by manipulating a single parameter — it’s like a chef sneaking in a secret ingredient that spoils the entire dish! Think of your router as a restaurant's kitchen. If a rogue diner can slip a harmful ingredient into the dish through a sneaky order, the whole meal (or network) is compromised. This vulnerability lets a cybercriminal use the ‘lanMask’ argument to overflow the buffer, potentially crashing or taking over your kitchen. With this exploit, an attacker could launch a remote attack, allowing them to manipulate your router's operations, access sensitive data, or even take control of your network. It's a highly unsettling scenario where your kitchen becomes a battleground for cyber warfare!

Put simply

Think of your router as a restaurant's kitchen. If a rogue diner can slip a harmful ingredient into the dish through a sneaky order, the whole meal (or network) is compromised. This vulnerability lets a cybercriminal use the ‘lanMask’ argument to overflow the buffer, potentially crashing or taking over your kitchen. This buffer overflow vulnerability occurs in the Tenda AC10U router's POST request handling when the 'lanMask' argument is manipulated, leading to potential unauthorized access and system compromise.

What to do

With this exploit, an attacker could launch a remote attack, allowing them to manipulate your router's operations, access sensitive data, or even take control of your network. It's a highly unsettling scenario where your kitchen becomes a battleground for cyber warfare! Update your Tenda AC10U router firmware to the latest version available immediately. Ensure that you regularly check for updates and consider disabling remote management features to mitigate risks. Additionally, review your network security settings for any unusual activity. You've got this! Stay proactive and secure your router to keep your network safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03327 · 88.5th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2025-12-30T09:15Z
Affected products (2)
ProductVersionsFixed in
tenda/ac10u_firmwareall versions—
tenda/ac10u_firmwareall versions—
References (5)
EPSS history
Timeline
  • 30 DEC 03:32Z
    Tenda AC10U POST Request Parameter AdvSetLanip fromadvsetlanip buffer overflow
    cvelistv5