CVE-2025-63834

A stored cross-site scripting (XSS) vulnerability was discovered in Tenda AC18 v15.03.05.05_multi

Medium · published November 10, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
14.2
In the wild
Unconfirmed
What it is

A stored cross-site scripting (XSS) vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. The vulnerability exists in the ssid parameter of the wireless settings. Remote attackers can inject malicious payloads that execute when any user visits the router's homepage.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00240 · 14.2th percentile
Published
2025-11-10T00:00Z
EPSS history
Timeline
  • 10 NOV 00:00Z
    A stored cross-site scripting (XSS) vulnerability was discovered in Tenda AC18 v15.03.05.05_multi
    cvelistv5