CVE-2025-10442

Katalog CVE

CVSS 8.8 · High EPSS 8,7%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada tenda ac9 firmware, tenda ac15 firmware. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14. This affects the function formexeCommand of the file /goform/exeCommand. This manipulation of the argument cmdinput causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Rincian

Terbit di NVD

15 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

8,7% peluang dieksploitasi; lebih tinggi dari 95,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/2664521593/mycve/blob/main/Tenda/Tenda_AC9_CJ.md exploit · advisory pihak ketiga
• https://github.com/2664521593/mycve/blob/main/Tenda/Tenda_AC9_CJ.md#poc exploit · advisory pihak ketiga
• https://vuldb.com/?id.323876 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.647838 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.647839 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.323876 permissions required
• https://www.tenda.com.cn/ product