CVE-2025-3203

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic was found in Tenda W18E 16.01.0.11. Affected by this vulnerability is the function formSetAccountList of the file /goform/setModules. The manipulation of the argument Password leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-119 CWE-121 CWE-787

Affected software

Vendor	Product	Versions
Tenda	W18E	16.01.0.11

References

https://github.com/ZIKH26/tmp_store_reports/blob/main/tenda-w18e.mdBroken Link
https://vuldb.com/?ctiid.303157Permissions Required, VDB Entry
https://vuldb.com/?id.303157Third Party Advisory, VDB Entry
https://vuldb.com/?submit.545883Third Party Advisory, VDB Entry
https://www.tenda.com.cn/Product
https://github.com/ZIKH26/tmp_store_reports/blob/main/tenda-w18e.mdBroken Link

Timeline

Published: Apr 4, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-320307.5Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerabil CVE-2025-320317.5Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerabil CVE-2025-320327.5The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Feder CVE-2025-320337.5The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Feder CVE-2025-320347.5The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Feder CVE-2025-320357.5DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 9.13.2, when uploadin CVE-2025-320366.5DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. The algorithm used to generate CVE-2025-320372.0Improper access control for some Intel(R) PresentMon before version 2.3.1 within Ring 3: User Applications may allow a denial of service. Ne CVE-2025-320386.7Uncontrolled search path for some FPGA Support Package for the Intel oneAPI DPC++C++ Compiler software before version 2025.0.1 within Ring 3 CVE-2025-32049.8A vulnerability, which was classified as critical, has been found in CodeAstro Car Rental System 1.0. Affected by this issue is some unknown CVE-2025-320447.5A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, cont CVE-2025-320455.3A flaw has been identified in Moodle where insufficient capability checks in certain grade reports allowed users without the necessary permi