A weakness has been identified in Tenda AC10U 15.03.06.48/15.03.06.49. Affected by this vulnerability is the function fromadvsetlanip of the file /goform/AdvSetLanip of the component POST Request Parameter Handler. Executing manipulation of the argument lanMask can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be exploited.
References
| Link | Resource |
|---|---|
| https://lavender-bicycle-a5a.notion.site/Tenda-AC10U-fromadvsetlanip-2d753a41781f800c86c8d388a38e8101?source=copy_link | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.338603 | Permissions Required VDB Entry |
| https://vuldb.com/?id.338603 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.725461 | Third Party Advisory VDB Entry |
| https://www.tenda.com.cn/ | Product |
Configurations
History
02 Jan 2026, 21:29
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lavender-bicycle-a5a.notion.site/Tenda-AC10U-fromadvsetlanip-2d753a41781f800c86c8d388a38e8101?source=copy_link - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.338603 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.338603 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.725461 - Third Party Advisory, VDB Entry | |
| References | () https://www.tenda.com.cn/ - Product | |
| First Time |
Tenda
Tenda ac10u Firmware Tenda ac10u |
|
| CPE | cpe:2.3:o:tenda:ac10u_firmware:15.03.06.48:*:*:*:*:*:*:* cpe:2.3:h:tenda:ac10u:1.0:*:*:*:*:*:*:* cpe:2.3:o:tenda:ac10u_firmware:15.03.06.49:*:*:*:*:*:*:* |
30 Dec 2025, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-30 04:15
Updated : 2026-01-02 21:29
NVD link : CVE-2025-15218
Mitre link : CVE-2025-15218
CVE.ORG link : CVE-2025-15218
JSON object : View
Products Affected
tenda
- ac10u_firmware
- ac10u