CVE-2025-32010

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A stack-based buffer overflow vulnerability exists in the Cloud API functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted HTTP response can lead to arbitrary code execution. An attacker can send an HTTP response to trigger this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

No affected versions have been published.

Timeline

Published: Aug 20, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-320119.8KUNBUS PiCtory versions 2.5.0 through 2.11.1 have an authentication bypass vulnerability where a remote attacker can bypass authentication t CVE-2025-320127.5Jellyfin is an open source self hosted media server. In versions 10.9.0 to before 10.10.7, the /System/Restart endpoint provides administrat CVE-2025-320137.5LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits' LNURL au CVE-2025-320146.9estree-util-value-to-estree converts a JavaScript value to an ESTree expression. When generating an ESTree from a value with a property name CVE-2025-320156.7FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, HTML is sanitized improperly inside the `<iframe srcdoc>` attribute,CVE-2025-320164.7Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the CVE-2025-320178.8Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management CVE-2025-320188.0Cursor is a code editor built for programming with AI. In versions 0.45.0 through 0.48.6, the Cursor app introduced a regression affecting t CVE-2025-320194.1Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as CVE-2025-32029.1A vulnerability classified as critical has been found in ageerle ruoyi-ai up to 2.0.0. Affected is an unknown function of the file ruoyi-mod CVE-2025-320209.3The crud-query-parser library parses query parameters from HTTP requests and converts them to database queries. Improper neutralization of t CVE-2025-320217.5Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source