CVE-2025-57217

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the Password parameter in the function R7WebsSecurityHandler.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-121

Affected software

No affected versions have been published.

Timeline

Published
Aug 28, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-572185.3Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the security_5g parameter in the function sCVE-2025-572195.3Incorrect access control in the endpoint /goform/ate of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 allows attackers to escalate priviCVE-2025-57224.8A vulnerability has been found in SourceCodester Student Result Management System 1.0 and classified as problematic. This vulnerability affeCVE-2025-572205.3An input validation flaw in the 'ate' service of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 to escalate privileges to root via a crafCVE-2025-572277.8An unquoted service path in Kingosoft Technology Ltd Kingo ROOT v1.5.8.3353 allows attackers to escalate privileges via placing a crafted exCVE-2025-57234.8A vulnerability was found in SourceCodester Student Result Management System 1.0 and classified as problematic. This issue affects some unknCVE-2025-572317.5Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST RequestCVE-2025-57244.8A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been classified as problematic. Affected is an unknCVE-2025-572406.1Cross site scripting (XSS) vulnerability in 17gz International Student service system 1.0 allows attackers to execute arbitrary code via theCVE-2025-572445.4OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user account creation interface. The Name field acCVE-2025-572479.1The BATBToken smart contract (address 0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2, Compiler Version v0.8.26+commit.8a97fa7a) contains incorreCVE-2025-572487.3A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu file. When the file is