CVE-2025-14286

HighCVSS 7.5/10Last modified Oct 7, 2026

Description

A vulnerability was determined in Tenda AC9 15.03.05.14_multi. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/DownloadCfg.jpg of the component Configuration File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-284

Affected software

Vendor	Product	Versions
Tenda	AC9	15.03.05.14_multi

References

https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN11.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.334874Permissions Required, VDB Entry
https://vuldb.com/?id.334874Third Party Advisory, VDB Entry
https://vuldb.com/?submit.702723Third Party Advisory, VDB Entry
https://www.tenda.com.cn/Product
https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN11.mdExploit, Third Party Advisory

Timeline

Published: Dec 9, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-142878.8A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the `mlflow/sagemaker/__init__.py` file at CVE-2025-142884.3The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for Wor CVE-2025-142895.4IBM webMethods Integration Server 12.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewe CVE-2025-14297.8A maliciously crafted MODEL file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can CVE-2025-142905.4IBM webMethods Integration (on prem) -Integration Server 10.15 through IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10 IBM webMethods Integrat CVE-2025-142936.5The WP Job Portal plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.4.0 via the 'downloadCus CVE-2025-142945.3The Razorpay for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on th CVE-2025-142957.0Storing Passwords in a Recoverable Format vulnerability in Automated Logic WebCTRL on Windows, Carrier i-Vu on Windows. Storing Passwords in CVE-2025-142985.4The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `thegem_te_s CVE-2025-142996.5The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthentic CVE-2025-14307.8A maliciously crafted SLDPRT file, when parsed through Autodesk AutoCAD, can force a Memory Corruption vulnerability. A malicious actor can CVE-2025-143008.1The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticate