CVE-2025-11120

A weakness has been identified in Tenda AC8 16.03.34.06. The affected element is the function formSetServerConfig of the file /goform/SetServerConfig. Executing manipulation can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
VulDBCNA
8.8 HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 25%
VendorProductVersion
tendaac18_firmware
16.03.34.06
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/alc9700jmo/CVE/issues/19
https://vuldb.com/?ctiid.326201
https://vuldb.com/?id.326201
https://vuldb.com/?submit.664065
https://www.tenda.com.cn/
https://github.com/alc9700jmo/CVE/issues/19