CVE-2025-11389

EUVD-2025-32099
A security flaw has been discovered in Tenda AC15 15.03.05.18. Affected is an unknown function of the file /goform/saveAutoQos. Performing a manipulation of the argument enable results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
tendaac15_firmware
15.03.05.18
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC15/saveAutoQos.md
https://vuldb.com/?ctiid.327316
https://vuldb.com/?id.327316
https://vuldb.com/?submit.664982
https://www.tenda.com.cn/