CVE-2025-5795

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in Tenda AC5 1.0/15.03.06.47. This affects the function fromadvsetlanip of the file /goform/AdvSetLanip. The manipulation of the argument lanMask leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
Tenda	AC5	1.0; 15.03.06.47

References

https://lavender-bicycle-a5a.notion.site/Tenda-AC5-fromadvsetlanip-20a53a41781f805389dcd51fa04bc530?source=copy_linkExploit, Third Party Advisory
https://vuldb.com/?ctiid.311349Permissions Required
https://vuldb.com/?id.311349Third Party Advisory, VDB Entry
https://vuldb.com/?submit.591224Third Party Advisory, VDB Entry
https://www.tenda.com.cn/Product
https://lavender-bicycle-a5a.notion.site/Tenda-AC5-fromadvsetlanip-20a53a41781f805389dcd51fa04bc530Exploit, Third Party Advisory

Timeline

Published: Jun 6, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-579505.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Glen Scott Plugin Security Scanner plu CVE-2025-579515.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ken107 SiteNarrator Text-to-Speech Wid CVE-2025-579525.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc Maps for WP maps-for-wp allow CVE-2025-579536.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 100plugins Open User Map open-user-map CVE-2025-579546.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Poll Maker poll-maker allows D CVE-2025-579556.5Missing Authorization vulnerability in Plugin Devs Post Carousel Slider for Elementor post-carousel-slider-for-elementor allows Exploiting I CVE-2025-579565.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpcraft WooMS wooms allows Stored XSS.CVE-2025-579575.3Missing Authorization vulnerability in wpcraft WooMS wooms allows Exploiting Incorrectly Configured Access Control Security Levels.This issu CVE-2025-579595.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tmatsuur Slightly troublesome permalin CVE-2025-57965.4A vulnerability has been found in code-projects Laundry System 1.0 and classified as problematic. This vulnerability affects unknown code of CVE-2025-579604.3Cross-Site Request Forgery (CSRF) vulnerability in TravelMap Travel Map travelmap-blog allows Cross Site Request Forgery.This issue affects CVE-2025-579614.3Missing Authorization vulnerability in Codexpert, Inc CoDesigner woolementor allows Exploiting Incorrectly Configured Access Control Securit