Login Request a demo
High severity · published Dec 30, 2025
CVE-2025-15215
Tenda AC10U HTTP POST Request setPptpUserList formSetPPTPUserList buffer overflow
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability was determined in Tenda AC10U 15.03.06.48/15.03.06.49. This affects the function formSetPPTPUserList of the file /goform/setPptpUserList of the component HTTP POST Request Handler. This manipulation of the argument list causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
AC10U · Tenda
15.03.06.48; 15.03.06.49 · source: vendor
AF
Ac10u Firmware · Tenda
15.03.06.48; 15.03.06.49 · source: NVD
Affected product
AC
AC10U
Tenda
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-15215
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-15215
VDB Entry
https://vuldb.com/?ctiid.338600
VDB Entry
https://vuldb.com/?id.338600
VDB Entry
https://vuldb.com/?submit.725365
Exploit
https://www.notion.so/Tenda-AC10U-setPptpUserList-2d753a41781f80e8ba6bc37ba6100343?pvs=73
Product
https://www.tenda.com.cn/
More from AC10U
9.8
CVE-2026-8263
Tenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injection
9.8
CVE-2024-2853
Tenda AC10U setsambacfg formSetSambaConf os command injection
9.8
CVE-2024-0924
Tenda AC10U formSetPPTPServer stack-based overflow
9.8
CVE-2023-44016
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the deviceId parameter in the addWifiMacFilter function
9.8
CVE-2023-44017
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the timeZone parameter in the fromSetSysTime function