CVE-2025-9523

Tenda AC1206 GetParentControlInfo stack-based overflow

CVSS 9.3 CRITICALEPSS 1.0%CWE-119 CWE-121

Vexday Risk Score

48Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 9.3EPSS 1.0%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

27 Aug 2025Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

A vulnerability was detected in Tenda AC1206 15.03.06.23. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument mac results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Affected products

Tenda · AC1206

public PoCs found — 1

cve_referencegithub.com/XXRicardo/iot-cve/blob/main/Tenda/AC1206/AC1206V1.0RTL_V15.03.06.23.mdunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/XXRicardo/iot-cve/blob/main/Tenda/AC1206/AC1206V1.0RTL_V15.03.06.23.md https://vuldb.com/?ctiid.321541 https://vuldb.com/?id.321541 https://vuldb.com/?submit.634309 https://www.tenda.com.cn/