Charbel

9 exploits Active since Dec 2025
CVE-2025-15230 WRITEUP HIGH WRITEUP
Tenda M3 1.0.0.13(4903) - Heap-based Buffer Overflow via qvlan_truck_port Parameter
A vulnerability was found in Tenda M3 1.0.0.13(4903). Affected by this issue is the function formSetVlanPolicy of the file /goform/setVlanPolicyData. Performing a manipulation of the argument qvlan_truck_port results in heap-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVSS 8.8
CVE-2025-15231 WRITEUP HIGH WRITEUP
Tenda M3 1.0.0.13(4903) - Stack-based Buffer Overflow via setVlanInfo ID/vlan/port Argument
A vulnerability was determined in Tenda M3 1.0.0.13(4903). This affects the function formSetRemoteVlanInfo of the file /goform/setVlanInfo. Executing a manipulation of the argument ID/vlan/port can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
CVSS 8.8
CVE-2025-15232 WRITEUP HIGH WRITEUP
Tenda M3 1.0.0.13(4903) - Stack-based Buffer Overflow via setAdPushInfo mac/terminal Parameter
A vulnerability was identified in Tenda M3 1.0.0.13(4903). This vulnerability affects the function formSetAdPushInfo of the file /goform/setAdPushInfo. The manipulation of the argument mac/terminal leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
CVSS 8.8
CVE-2025-15233 WRITEUP HIGH WRITEUP
Tenda M3 1.0.0.13(4903) - Heap-based Buffer Overflow via formSetAdInfoDetails
A security flaw has been discovered in Tenda M3 1.0.0.13(4903). This issue affects the function formSetAdInfoDetails of the file /goform/setAdInfoDetail. The manipulation of the argument adName/smsPassword/smsAccount/weixinAccount/weixinName/smsSignature/adRedirectUrl/adCopyRight/smsContent/adItemUID results in heap-based buffer overflow. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
CVSS 8.8
CVE-2025-15234 WRITEUP HIGH WRITEUP
Tenda M3 1.0.0.13(4903) - Heap-based Buffer Overflow via formSetRemoteInternetLanInfo
A weakness has been identified in Tenda M3 1.0.0.13(4903). Impacted is the function formSetRemoteInternetLanInfo of the file /goform/setInternetLanInfo. This manipulation of the argument portIp/portMask/portGateWay/portDns/portSecDns causes heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVSS 8.8
CVE-2025-15252 WRITEUP HIGH WRITEUP
Tenda M3 1.0.0.13(4903) - Stack-Based Buffer Overflow via formSetRemoteDhcpForAp
A flaw has been found in Tenda M3 1.0.0.13(4903). The affected element is the function formSetRemoteDhcpForAp of the file /goform/setDhcpAP. This manipulation of the argument startip/endip/leasetime/gateway/dns1/dns2 causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.
CVSS 8.8
CVE-2025-15253 WRITEUP HIGH WRITEUP
Tenda M3 1.0.0.13(4903) - Stack-Based Buffer Overflow via /goform/exeCommand cmdinput Argument
A vulnerability has been found in Tenda M3 1.0.0.13(4903). The impacted element is an unknown function of the file /goform/exeCommand. Such manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS 8.8
CVE-2025-15254 WRITEUP MEDIUM WRITEUP
Tenda W6-S 1.0.0.4(510) - OS Command Injection via TendaAte Function
A vulnerability was found in Tenda W6-S 1.0.0.4(510). This affects the function TendaAte of the file /goform/ate of the component ATE Service. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used.
CVSS 6.3
CVE-2025-15255 WRITEUP CRITICAL WRITEUP
Tenda W6-S 1.0.0.4(510) - Stack-Based Buffer Overflow via Cookie Argument
A vulnerability was determined in Tenda W6-S 1.0.0.4(510). This impacts an unknown function of the file /bin/httpd of the component R7websSsecurityHandler. Executing a manipulation of the argument Cookie can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS 9.8