High severity · published Jul 21, 2025
CVE-2025-7914
Tenda AC6 httpd setparentcontrolinfo buffer overflow
8.8
CVSS
1%
EPSS
No
On KEV
Description
A vulnerability has been found in Tenda AC6 15.03.06.50 and classified as critical. Affected by this vulnerability is the function setparentcontrolinfo of the component httpd. The manipulation leads to buffer overflow. The attack can be launched remotely.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
AC6 · Tenda
15.03.06.50 · source: vendor
AF
Ac6 Firmware · Tenda
15.03.06.50 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-7914
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-7914
Third Party Advisory
https://github.com/gaochen61/IoTVuln/blob/main/Tenda_AC6_V15.03.06.50/setparentcontrolinfo.md
Permissions Required
https://vuldb.com/?ctiid.317029
Third Party Advisory
https://vuldb.com/?id.317029
Third Party Advisory
https://vuldb.com/?submit.618859
Product
https://www.tenda.com.cn/
More from AC6
9.8
CVE-2025-5855
Tenda AC6 SetRebootTimer formSetRebootTimer stack-based overflow
9.8
CVE-2025-1814
Tenda AC6 WifiExtraSet stack-based overflow
9.8
CVE-2025-0349
Tenda AC6 GetParentControlInfo stack-based overflow
9.8
CVE-2024-10698
Tenda AC6 SetOnlineDevName formSetDeviceName stack-based overflow
9.8
CVE-2024-10697
Tenda AC6 API Endpoint WriteFacMac formWriteFacMac command injection