CVE-2025-60339
BaseFortify
Publication date: 2025-10-22
Last updated on: 2025-10-27
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | ac6_firmware | 15.03.06.50 |
| tenda | ac6 | 2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves multiple buffer overflow issues in the openSchedWifi function of the Tenda AC6 router firmware version 15.03.06.50. Attackers can exploit these flaws by injecting specially crafted payloads into the schedStartTime and schedEndTime parameters, which can cause the device to crash or behave unexpectedly. [1]
How can this vulnerability impact me? :
Exploiting this vulnerability can lead to a Denial of Service (DoS) condition on the affected Tenda AC6 device, making the device unavailable or unresponsive. This can disrupt network connectivity and potentially impact any services relying on the router. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can be performed by monitoring for unusual or malformed packets targeting the schedStartTime and schedEndTime parameters of the openSchedWifi function in Tenda AC6 devices. Specific commands are not detailed in the provided resources, but reviewing network traffic for suspicious payloads or using the proof-of-concept code available in Resource 1 may assist in detection. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use of vulnerable firmware versions of Tenda AC6 (v.15.03.06.50) and restricting access to the device's management interface to trusted networks only. Applying any available patches or updates from the vendor is recommended. Additionally, monitoring and filtering network traffic to block crafted payloads targeting schedStartTime and schedEndTime parameters can help reduce risk. [1]