CVE-2025-63835

Name of the Vulnerable Software and Affected Versions Tenda AC18 version 15.03.05.05 multi

Description A stack-based buffer overflow issue exists in Tenda AC18 version 15.03.05.05 multi. The issue is located in the guestSsid parameter of the /goform/WifiGuestSet API endpoint. Sending oversized data to the guestSsid parameter can lead to a denial of service (device crash) or potential remote code execution.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the size of data sent to the guestSsid parameter in the /goform/WifiGuestSet API endpoint.