CVE-2025-15255

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was determined in Tenda W6-S 1.0.0.4(510). This impacts an unknown function of the file /bin/httpd of the component R7websSsecurityHandler. Executing a manipulation of the argument Cookie can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-121

Affected software

Vendor	Product	Versions
Tenda	W6-S	1.0.0.4(510)

References

https://github.com/dwBruijn/CVEs/blob/main/Tenda/R7WebsSecurityHandler.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.338645Permissions Required, VDB Entry
https://vuldb.com/?id.338645Third Party Advisory, VDB Entry
https://vuldb.com/?submit.725500Third Party Advisory, VDB Entry
https://www.tenda.com.cn/Product
https://github.com/dwBruijn/CVEs/blob/main/Tenda/R7WebsSecurityHandler.mdExploit, Third Party Advisory

Timeline

Published: Dec 30, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-152569.8A vulnerability was identified in Edimax BR-6208AC 1.02/1.03. Affected is the function formStaDrvSetup of the file /goform/formStaDrvSetup o CVE-2025-152579.8A security flaw has been discovered in Edimax BR-6208AC 1.02/1.03. Affected by this vulnerability is the function formRoute of the file /gog CVE-2025-152586.1A weakness has been identified in Edimax BR-6208AC 1.02/1.03. Affected by this issue is the function formALGSetup of the file /goform/formAL CVE-2025-15265.4The DethemeKit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the De Product Display Widget (countdown CVE-2025-152606.5The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization in all versions up to CVE-2025-152627.2A security flaw has been discovered in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/edit.php of the co CVE-2025-152639.8A weakness has been identified in BiggiDroid Simple PHP CMS 1.0. Affected is an unknown function of the file /admin/login.php of the compone CVE-2025-152647.3A vulnerability was determined in FeehiCMS up to 2.1.1. Impacted is an unknown function of the file frontend/web/timthumb.php of the compone CVE-2025-152656.1An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable. The key is embedded inside a <script> block wit CVE-2025-152667.2The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to Stored Cross-Site Scrip CVE-2025-152676.4The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_accordion_item shortcode in a CVE-2025-152687.5The Infility Global plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'infility_get_data' API action in all versio