CVE-2025-67073
Buffer Overflow in Tenda AC10V4 HTTPD Enables Remote Code Execution
Publication date: 2025-12-17
Last updated on: 2025-12-17
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | ac10v4 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a buffer overflow in the function fromAdvSetMacMtuWan of the binary httpd in Tenda AC10V4.0 V16.03.10.20. It allows remote attackers to send a crafted POST request with a specially crafted payload in the 'serviceName' field to the /goform/AdvSetMacMtuWan endpoint, which can cause a denial of service or potentially allow code execution.
How can this vulnerability impact me? :
The vulnerability can lead to denial of service, making the affected device unavailable. Additionally, it may allow remote attackers to execute arbitrary code, potentially compromising the device and the network it is connected to.