CVE-2025-9090CWE-74CWE-77

Tenda AC20 Telnet Service telnet websFormDefine command injection

Medium · published August 17, 2025

CVSS v4.0

5.3

EPSS

17%

Percentile

97.0

In the wild

Unconfirmed

What it is

A vulnerability was identified in Tenda AC20 16.03.08.12. Affected is the function websFormDefine of the file /goform/telnet of the component Telnet Service. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

The record

Technical detail

CVSS v4.0: 5.3 · MEDIUM
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS: 0.16651 · 97.0th percentile
Weaknesses: CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published: 2025-08-17T02:02Z

EPSS history

Timeline

17 AUG 02:02Z
Tenda AC20 Telnet Service telnet websFormDefine command injection
cvelistv5