CVE-20XX-?

CVE-2025-3328

8.7 HIGH 8% exploit odds No fix listed Memory safety Device

What it is

A vulnerability was found in Tenda AC1206 15.03.06.23. It has been classified as critical. Affected is the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set. The manipulation of the argument ssid/timeZone leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

At a glance

Exploitability
Can be exploited over the network with a low-privilege account. High risk of data exposure, data tampering, service disruption.
Exploit odds
7.6% chance of exploitation in the next 30 days (EPSS).
Fix
No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

  1. PublishedDisclosed publicly on CVE.org and NVD
  2. Last updatedMost recent change to the record

Details

Published
Last modified
Exploit probability
7.6% · EPSS, next 30 days
Weakness
CWE-119 · Buffer errors
Record status
Analyzed

Affected

Attack profile CVSS 4.0 · 8.7

Attack vector
Network
Complexity
Low
Attack requirements
None
Privileges needed
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Raw vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Meme: I wake up, CVE-2025-3328
Download Square Reddit

References

NVD record · CVE.org record