First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-57638

HighCVSS 7.5/10Last modified Nov 5, 2026

Description

Buffer overflow vulnerability in Tenda AC9 1.0 via the user supplied sys.vendor configuration value.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/glkfc/IoT-Vulnerability/blob/main/Tenda/tenda1.mdExploit, Third Party Advisory

Timeline

Published: Sep 23, 2025
Last modified: Nov 5, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-576396.5OS Command injection vulnerability in Tenda AC9 1.0 was discovered to contain a command injection vulnerability via the usb.samba.guest.user CVE-2025-57645.4A vulnerability was found in code-projects Laundry System 1.0 and classified as problematic. Affected by this issue is some unknown function CVE-2025-576427.2A Shell Upload vulnerability in Tourism Management System 2.0 allows an attacker to upload and execute arbitrary PHP shell scripts on the se CVE-2025-576449.1Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticated administrative use CVE-2025-57655.4A vulnerability was found in code-projects Laundry System 1.0. It has been classified as problematic. This affects an unknown part of the fi CVE-2025-57664.3A vulnerability was found in code-projects Laundry System 1.0. It has been declared as problematic. This vulnerability affects unknown code.CVE-2025-576656.4Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security ab CVE-2025-57676.4The Crowdfunding for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions CVE-2025-576815.4The WorklogPRO - Timesheets for Jira plugin in Jira Data Center before version 4.23.6-jira10 and before version 4.23.5-jira9 allows users an CVE-2025-576826.5Directory Traversal vulnerability in Papermark 0.20.0 and prior allows authenticated attackers to retrieve arbitrary files from an S3 bucket CVE-2025-576858.8The LB-Link routers, including the BL-AC2100_AZ3 V1.0.4, BL-WR4000 v2.5.0, BL-WR9000_AE4 v2.4.9, BL-AC1900_AZ2 v1.0.2, BL-X26_AC8 v1.2.8, an CVE-2025-57696.1The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encodi

CVE-2025-57638: High severity, CVSS 7.5 | Vulnix