Login Request a demo
High severity · published May 18, 2025
CVE-2025-4897
A vulnerability was found in Tenda A15 15.13.07.09/15.13.07.13
7.5
CVSS
7.2%
EPSS
No
On KEV
Description
A vulnerability was found in Tenda A15 15.13.07.09/15.13.07.13. It has been classified as critical. This affects an unknown part of the file /goform/multimodalAdd of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.2% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
A15 Firmware · Tenda
15.13.07.09; 15.13.07.13 · source: NVD
Affected product
AF
A15 Firmware
Tenda
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-4897
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-4897
Broken Link
https://github.com/byxs0x0/cve2/blob/main/tenda%20AC15.md
Permissions Required
https://vuldb.com/?ctiid.309453
Third Party Advisory
https://vuldb.com/?id.309453
Third Party Advisory
https://vuldb.com/?submit.578035
Product
https://www.tenda.com.cn/
More from A15 Firmware
9.8
CVE-2026-4567
Tenda A15 UploadCfg stack-based overflow
9.8
CVE-2025-12619
A vulnerability was found in Tenda A15 15.13.07.13
9.8
CVE-2022-47128
Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey2 parameter at /goform/WifiBasicSet
9.8
CVE-2022-47127
Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlPwd parameter at /goform/WifiBasicSet
9.8
CVE-2022-47126
Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet