High severity · published Dec 30, 2025
CVE-2025-15218
Tenda AC10U POST Request Parameter AdvSetLanip fromadvsetlanip buffer overflow
8.8
CVSS
3.3%
EPSS
No
On KEV
Description
A weakness has been identified in Tenda AC10U 15.03.06.48/15.03.06.49. Affected by this vulnerability is the function fromadvsetlanip of the file /goform/AdvSetLanip of the component POST Request Parameter Handler. Executing a manipulation of the argument lanMask can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
AC10U · Tenda
15.03.06.48; 15.03.06.49 · source: vendor
AF
Ac10u Firmware · Tenda
15.03.06.48; 15.03.06.49 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-15218
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-15218
Exploit
https://lavender-bicycle-a5a.notion.site/Tenda-AC10U-fromadvsetlanip-2d753a41781f800c86c8d388a38e8101?source=copy_link
Permissions Required
https://vuldb.com/?ctiid.338603
Third Party Advisory
https://vuldb.com/?id.338603
Third Party Advisory
https://vuldb.com/?submit.725461
Product
https://www.tenda.com.cn/
More from AC10U
9.8
CVE-2026-8263
Tenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injection
9.8
CVE-2024-2853
Tenda AC10U setsambacfg formSetSambaConf os command injection
9.8
CVE-2024-0924
Tenda AC10U formSetPPTPServer stack-based overflow
9.8
CVE-2023-44016
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the deviceId parameter in the addWifiMacFilter function
9.8
CVE-2023-44017
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the timeZone parameter in the fromSetSysTime function