PT-2025-33124

CVE-2025-8940

Published

2025-08-11

Updated

2025-08-19

Description by

CVSS 2.0

9.0

High

MetricsAV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Tenda AC20 versions prior to 16.03.08.13

Description: A vulnerability exists in Tenda AC20 routers due to a buffer overflow in the strcpy function within the /goform/saveParentControlInfo file. Manipulation of the Time argument leads to the overflow, and the attack can be launched remotely. The exploit for this issue has been publicly disclosed.

Recommendations: Update Tenda AC20 to version 16.03.08.13 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Qmssdxn

Vendors

Affected products

Weakness enumeration

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-120: Buffer Copy without Checking Size of Input (\'Classic Buffer Overflow\')