CVE-2025-5836
Tenda AC9 POST Request SetIPTVCfg formSetIptv command injection
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jun 7, 2025
- Updated
- Jun 9, 2025
- Reserved
- Jun 6, 2025
Description
A vulnerability was found in Tenda AC9 15.03.02.13. It has been rated as critical. This issue affects the function formSetIptv of the file /goform/SetIPTVCfg of the component POST Request Handler. The manipulation of the argument list leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
AC9Tenda |
|
References
- VDB-311579 | Tenda AC9 POST Request SetIPTVCfg formSetIptv command injectionvdb-entrytechnical-description
- VDB-311579 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #591363 | Tenda AC9 V1.0 V15.03.02.13 Command Injectionthird-party-advisory
- https://candle-throne-f75.notion.site/Tenda-AC9-formSetIptv-209df0aa11858061ae2bcbf83918d034exploit
- https://www.tenda.com.cn/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.