CVE-2025-11385

HighCVSS 8.8/10Last modified Oct 8, 2026

Description

A vulnerability has been found in Tenda AC20 up to 16.03.08.12. The affected element is the function sscanf of the file /goform/fast_setting_wifi_set. The manipulation of the argument timeZone leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
Tenda	AC20	16.03.08.0; 16.03.08.1; 16.03.08.2; 16.03.08.3; 16.03.08.4; 16.03.08.5; 16.03.08.6; 16.03.08.7; 16.03.08.8; 16.03.08.9; 16.03.08.10; 16.03.08.11; 16.03.08.12

References

https://github.com/cymiao1978/cve/blob/main/11.mdExploit, Third Party Advisory
https://github.com/cymiao1978/cve/blob/main/11.md#pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.327312Permissions Required, VDB Entry
https://vuldb.com/?id.327312Third Party Advisory, VDB Entry
https://vuldb.com/?submit.664922Third Party Advisory, VDB Entry
https://www.tenda.com.cn/Product

Timeline

Published: Oct 7, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-113868.8A vulnerability was found in Tenda AC15 15.03.05.18. The impacted element is an unknown function of the file /goform/SetDDNSCfg of the compo CVE-2025-113878.8A vulnerability was determined in Tenda AC15 15.03.05.18. This affects an unknown function of the file /goform/fast_setting_pppoe_set. This CVE-2025-113888.8A vulnerability was identified in Tenda AC15 15.03.05.18. This impacts an unknown function of the file /goform/setNotUpgrade. Such manipulat CVE-2025-113898.8A security flaw has been discovered in Tenda AC15 15.03.05.18. Affected is an unknown function of the file /goform/saveAutoQos. Performing a CVE-2025-11394.4IBM Edge Application Manager 4.5 could allow a local user to read or modify resources that they should not have authorization to access due CVE-2025-113906.1A weakness has been identified in PHPGurukul Cyber Cafe Management System 1.0. Affected by this vulnerability is an unknown functionality of CVE-2025-113919.8The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file t CVE-2025-113938.7A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the prox CVE-2025-113955.5A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host ma CVE-2025-113969.8A vulnerability was identified in code-projects Simple Food Ordering System 1.0. Impacted is an unknown function of the file /product.php. S CVE-2025-113979.8A security flaw has been discovered in SourceCodester Hotel and Lodge Management System 1.0. The affected element is an unknown function of CVE-2025-113988.8A weakness has been identified in SourceCodester Hotel and Lodge Management System 1.0. The impacted element is an unknown function of the f