CVE-2025-57296
MEDIUM EXPLOITEDTenda Ac6 Firmware - Command Injection
Title source: ruleDescription
Tenda AC6 router firmware 15.03.05.19 contains a command injection vulnerability in the formSetIptv function, which processes requests to the /goform/SetIPTVCfg web interface. When handling the list and vlanId parameters, the sub_ADBC0 helper function concatenates these user-supplied values into nvram set system commands using doSystemCmd, without validating or sanitizing special characters (e.g., ;, ", #). An unauthenticated or authenticated attacker can exploit this by submitting a crafted POST request, leading to arbitrary system command execution on the affected device.
Scores
CVSS v3
6.5
EPSS
0.0158
EPSS Percentile
81.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
VulnCheck KEV
2026-03-11
CWE
CWE-77
Status
published
Products (1)
tenda/ac6_firmware
15.03.05.19
Published
Sep 19, 2025
Tracked Since
Feb 18, 2026