CVE-2025-4897

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in Tenda A15 15.13.07.09/15.13.07.13. It has been classified as critical. This affects an unknown part of the file /goform/multimodalAdd of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
Tenda	A15	15.13.07.09; 15.13.07.13

References

https://github.com/byxs0x0/cve2/blob/main/tenda%20AC15.mdBroken Link
https://vuldb.com/?ctiid.309453Permissions Required, VDB Entry
https://vuldb.com/?id.309453Third Party Advisory, VDB Entry
https://vuldb.com/?submit.578035Third Party Advisory, VDB Entry
https://www.tenda.com.cn/Product

Timeline

Published: May 18, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-489767.5Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue CVE-2025-489776.5Relative Path Traversal vulnerability in Apache Ignite REST API. Authenticated REST API users can read any file on the server with "cmd=log CVE-2025-489787.5An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) could allow a Command Injection by a malicious actor with ac CVE-2025-489793.4An Improper Input Validation in UISP Application could allow a Command Injection by a malicious actor with High Privileges and local access.CVE-2025-48985.4A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as critical. This vulnerability affec CVE-2025-489806.5In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item CVE-2025-489818.6An insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows attackers within the intranet to eavesdrop and mani CVE-2025-489827.8This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator is tricked into rest CVE-2025-489839.9A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructur CVE-2025-489848.8A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.CVE-2025-489855.3A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to byp CVE-2025-489868.8Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email addre