by Kastro
Paper/Archive/CVE-2025-13446

CVE-2025-13446

Tenda AC21 — Tenda AC21 SetSysTimeCfg stack-based overflow

EPSS 4%public exploitCVSS 9.8
critical.is priorityof 100
58
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 90.9.909 × 2018.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability has been found in Tenda AC21 16.03.08.16. This vulnerability affects unknown code of the file /goform/SetSysTimeCfg. The manipulation of the argument timeZone/time leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

Affected

ProductAffectedFixed inSource
AC2116.03.08.16–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)8.8CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

writeupvuldb.com/?id.333018refvuldb.com/?ctiid.333018writeupvuldb.com/?submit.694425writeupvuldb.com/?submit.694430exploitgithub.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN8.mdexploitgithub.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN9.mdreftenda.com.cn