CVE-2025-57296

MEDIUM EXPLOITED

Tenda Ac6 Firmware - Command Injection

Title source: rule

Description

Tenda AC6 router firmware 15.03.05.19 contains a command injection vulnerability in the formSetIptv function, which processes requests to the /goform/SetIPTVCfg web interface. When handling the list and vlanId parameters, the sub_ADBC0 helper function concatenates these user-supplied values into nvram set system commands using doSystemCmd, without validating or sanitizing special characters (e.g., ;, ", #). An unauthenticated or authenticated attacker can exploit this by submitting a crafted POST request, leading to arbitrary system command execution on the affected device.

Scores

CVSS v3 6.5
EPSS 0.0158
EPSS Percentile 81.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

VulnCheck KEV 2026-03-11
CWE
CWE-77
Status published
Products (1)
tenda/ac6_firmware 15.03.05.19
Published Sep 19, 2025
Tracked Since Feb 18, 2026