Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Tenda AC6 Routers: Unauthenticated Remote Code Execution

CVE-2025-0349 · published 1 year ago
Summary

A critical security issue in Tenda AC6 routers can allow an attacker to remotely execute code on the router, potentially leading to unauthorized access and control. This vulnerability was publicly disclosed, so it's essential to update the router's firmware as soon as possible to prevent exploitation. Tenda users should check for and install the latest firmware version to ensure their router's security.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
tenda ac6_firmware 15.03.05.16
cpe:2.3:o:tenda:ac6_firmware:15.03.05.16:*:*:*:*:*:*:*
Original advisory text
A vulnerability classified as critical has been found in Tenda AC6 15.03.05.16. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argum...
A vulnerability classified as critical has been found in Tenda AC6 15.03.05.16. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument src/mac leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.7 High
Exploitation
2% chance of attack within 30 days
Type
CWE-119Buffer Overflow
CWE-121Stack-based Buffer Overflow
CWE-787Out-of-bounds Write
Timeline
Published9 Jan 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-0349 · NVD
Track software like this
Free during beta