CVE-2025-9090

Tenda AC20 Telnet Service telnet websFormDefine command injection

CVSS 5.3 MEDIUMEPSS 14.1%CWE-74 CWE-77

A vulnerability was identified in Tenda AC20 16.03.08.12. Affected is the function websFormDefine of the file /goform/telnet of the component Telnet Service. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Produtos afetados

Tenda · AC20

PoCs públicas encontradas — 3

githubgithub.com/byteReaper77/CVE-2025-9090★ 1 cve_referencegithub.com/ZZ2266/.github.io/blob/main/AC20/telnet/readme.md#poc-exploit-stepsnão verificado exploitdbwww.exploit-db.com/exploits/52418não verificado

⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/ZZ2266/.github.io/blob/main/AC20/telnet/readme.md https://github.com/ZZ2266/.github.io/blob/main/AC20/telnet/readme.md#poc-exploit-steps https://vuldb.com/?ctiid.320358 https://vuldb.com/?id.320358 https://vuldb.com/?submit.632232 https://www.tenda.com.cn/