CVE-2025-15356CWE-119CWE-120

Tenda AC20 PowerSaveSet sscanf buffer overflow

High · published December 30, 2025

CVSS v4.0
8.7
EPSS
4%
Percentile
90.5
In the wild
Unconfirmed
What it is

⚡ A remote buffer overflow vulnerability lurks in the Tenda AC20, just waiting for the right command to crash your network! 🚨 Think of it like a waiter who keeps bringing out more and more dishes without checking if the table has space — eventually, everything spills over, and chaos ensues. That's exactly what happens here when the system doesn't manage its memory properly! An attacker could trigger this overflow remotely, potentially crashing your router, leading to service disruptions and exposing your home network to further attacks. It’s not just a nuisance; it could leave your devices vulnerable and functioning improperly!

Put simply

Think of it like a waiter who keeps bringing out more and more dishes without checking if the table has space — eventually, everything spills over, and chaos ensues. That's exactly what happens here when the system doesn't manage its memory properly! The vulnerability stems from improper handling of arguments in the sscanf function within the /goform/PowerSaveSet file, which can be exploited to cause a buffer overflow, allowing attackers to manipulate the device remotely.

What to do

An attacker could trigger this overflow remotely, potentially crashing your router, leading to service disruptions and exposing your home network to further attacks. It’s not just a nuisance; it could leave your devices vulnerable and functioning improperly! Update your Tenda AC20 to the latest firmware version beyond 16.03.08.12 as soon as possible to patch this vulnerability. Additionally, regularly review your device’s security settings and check for any unauthorized access attempts. You've got this! With these steps, you can secure your network like a pro! 🛡️

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.04000 · 90.5th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2025-12-30T20:32Z
EPSS history
Timeline
  • 30 DEC 20:32Z
    Tenda AC20 PowerSaveSet sscanf buffer overflow
    cvelistv5