CVE-2025-3786

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Tenda AC15 up to 15.03.05.19 and classified as critical. This issue affects the function fromSetWirelessRepeat of the file /goform/WifiExtraSet. The manipulation of the argument mac leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119CWE-120

Affected software

VendorProductVersions
TendaAC1515.03.05.0; 15.03.05.1; 15.03.05.2; 15.03.05.3; 15.03.05.4; 15.03.05.5; 15.03.05.6; 15.03.05.7; 15.03.05.8; 15.03.05.9; 15.03.05.10; 15.03.05.11; 15.03.05.12; 15.03.05.13; 15.03.05.14; 15.03.05.15; 15.03.05.16; 15.03.05.17; 15.03.05.18; 15.03.05.19

References

Timeline

Published
Apr 18, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-378605.5In the Linux kernel, the following vulnerability has been resolved: sfc: fix NULL dereferences in ef100_process_design_param() Since citedCVE-2025-378617.8In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queuCVE-2025-378625.5In the Linux kernel, the following vulnerability has been resolved: HID: pidff: Fix null pointer dereference in pidff_find_fields This funCVE-2025-378635.5In the Linux kernel, the following vulnerability has been resolved: ovl: don't allow datadir only In theory overlayfs could support upper CVE-2025-378645.5In the Linux kernel, the following vulnerability has been resolved: net: dsa: clean up FDB, MDB, VLAN entries on unbind As explained in maCVE-2025-378655.5In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsuppoCVE-2025-378665.5In the Linux kernel, the following vulnerability has been resolved: mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() A CVE-2025-378675.5In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Silence oversized kvmalloc() warning syzkaller triggered anCVE-2025-378685.5In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: fix notifier vs folio deadlock User is reporting what CVE-2025-378697.8In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use local fence in error path of xe_migrate_clear The intent oCVE-2025-37876.5A vulnerability was found in PbootCMS 3.2.5. It has been classified as problematic. Affected is an unknown function of the component Image HCVE-2025-378705.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: prevent hang on link training fail [Why] When link tr
CVE-2025-3786: High severity, CVSS 8.8 | Vulnix