by Kastro
Paper/Archive/CVE-2025-1819

CVE-2025-1819

Tenda AC7 1200M — Tenda AC7 1200M telnet TendaTelnet os command injection

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 78.3.783 × 2015.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability, which was classified as critical, was found in Tenda AC7 1200M 15.03.06.44. Affected is the function TendaTelnet of the file /goform/telnet. The manipulation of the argument lan_ip leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected

ProductAffectedFixed inSource
AC7 1200M15.03.06.44–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDB (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.298092refvuldb.com/?ctiid.298092writeupvuldb.com/?submit.504429exploitgithub.com/Raining-101/IOT_cve/blob/main/Tenda%20a7%20V15.03.06.44%20Command%20injection.mdreftenda.com.cn