CVE-2025-13445

CriticalCVSS 9.8/10Last modified Oct 18, 2026

Description

A flaw has been found in Tenda AC21 16.03.08.16. This affects an unknown part of the file /goform/SetIpMacBind. Executing a manipulation of the argument list can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-121

Affected software

Vendor	Product	Versions
Tenda	AC21	16.03.08.16

References

https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN7.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.333017Permissions Required, VDB Entry
https://vuldb.com/?id.333017Third Party Advisory, VDB Entry
https://vuldb.com/?submit.694066Third Party Advisory, VDB Entry
https://www.tenda.com.cn/Product
https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN7.mdExploit, Third Party Advisory

Timeline

Published: Nov 20, 2025
Last modified: Oct 18, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-134469.8A vulnerability has been found in Tenda AC21 16.03.08.16. This vulnerability affects unknown code of the file /goform/SetSysTimeCfg. The man CVE-2025-134476.8OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administr CVE-2025-134486.4The CSSIgniter Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'element' shortcode attribute in all ver CVE-2025-134499.8A vulnerability was found in code-projects Online Shop Project 1.0. This issue affects some unknown processing of the file /login.php. The m CVE-2025-134505.4A vulnerability was determined in SourceCodester Online Shop Project 1.0. Impacted is an unknown function of the file /shop/register.php. Th CVE-2025-134519.8A vulnerability was identified in SourceCodester Online Shop Project 1.0. The affected element is an unknown function of the file /action.ph CVE-2025-134524.3The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to Missing Authorization in all v CVE-2025-134534.6A potential vulnerability was reported in some ThinkPlus USB drives that could allow a user with physical access to read data stored on the CVE-2025-134545.5A potential vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to gain access to sen CVE-2025-134557.8A vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to bypass ThinkPlus device auth CVE-2025-134566.1The ShopBuilder WordPress plugin before 3.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a CVE-2025-134577.5The WooCommerce Square plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.1 vi