CVE-2025-4299

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Tenda AC1206 up to 15.03.06.23. It has been rated as critical. This issue affects the function setSchedWifi of the file /goform/openSchedWifi. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
Tenda	AC1206	15.03.06.0; 15.03.06.1; 15.03.06.2; 15.03.06.3; 15.03.06.4; 15.03.06.5; 15.03.06.6; 15.03.06.7; 15.03.06.8; 15.03.06.9; 15.03.06.10; 15.03.06.11; 15.03.06.12; 15.03.06.13; 15.03.06.14; 15.03.06.15; 15.03.06.16; 15.03.06.17; 15.03.06.18; 15.03.06.19

References

https://github.com/CH13hh/tmp_store_cc/blob/main/AC1206/AC1206setSchedWifi/setSchedWifi.mdBroken Link
https://vuldb.com/?ctiid.307403Permissions Required, VDB Entry
https://vuldb.com/?id.307403Third Party Advisory, VDB Entry
https://vuldb.com/?submit.563558Third Party Advisory, VDB Entry
https://www.tenda.com.cn/Product

Timeline

Published: May 6, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-429903.0Unprotected SAPUI5 applications allow an attacker with basic privileges to inject malicious HTML code into a webpage, with the goal of redir CVE-2025-429914.3SAP S/4HANA (Bank Account Application) does not perform necessary authorization checks. This allows an authenticated 'approver' user to dele CVE-2025-429926.9SAPCAR allows an attacker logged in with high privileges to create a malicious SAR archive in SAPCAR. This could enable the attacker to expl CVE-2025-429936.7Due to a missing authorization check vulnerability in SAP S/4HANA (Enterprise Event Enablement), an attacker with access to the Inbound Bind CVE-2025-429947.5SAP MDM Server ReadString function allows an attacker to send specially crafted packets which could trigger a memory read access violation i CVE-2025-429957.5SAP MDM Server Read function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the CVE-2025-429965.6SAP MDM Server allows an attacker to gain control of existing client sessions and execute certain functions without having to re-authenticat CVE-2025-429976.6Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the applicat CVE-2025-429985.3The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 Forbidd CVE-2025-429999.1SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when d CVE-2025-43009.8A vulnerability classified as critical has been found in itsourcecode Content Management System 1.0. Affected is an unknown function of the CVE-2025-430007.9Under certain conditions Promotion Management Wizard (PMW) allows an attacker to access information which would otherwise be restricted.This