What is the CVSS score of CVE-2025-14654?

CVE-2025-14654 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 3.3%.

Is there a public PoC exploit available for CVE-2025-14654?

Yes, a public proof-of-concept exploit is available for CVE-2025-14654. Prioritise patching immediately. EPSS: 3.3%.

How to fix or mitigate CVE-2025-14654?

Within 24 hours: inventory all Tenda AC20 devices running firmware 16.03.08.12, immediately disable remote management, and restrict web interface access to trusted internal IPs via firewall rules. Monitor logs for requests to /goform/setPptpUserList with unusually large 'list' parameters. Within 7 days: isolate affected routers on a dedicated VLAN, enforce strong unique credentials, and consider replacing devices if they are internet-facing or business-critical. Within 30 days: engage Tenda support for patch status, evaluate alternative router models with active security support, and if a patch is released, test and deploy it promptly across all affected devices.

Tenda AC20 CVE-2025-14654

HIGH

Buffer Overflow (CWE-119)

2025-12-14 cna@vuldb.com

Buffer Overflow Tenda Ac20 Firmware

7.4

CVSS 4.0 · Vendor: vuldb

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate to router web interface
Exploit

Send crafted POST to /goform/setPptpUserList
Execution

Overflow stack buffer in formSetPPTPUserList
Impact

Execute code or crash httpd on device

Vulnerability Assessment

Weakness	CWE CWE-119 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, buffer size validation MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires that the attacker can reach the Tenda AC20 httpd web-management service and authenticate with at least low-privilege credentials (CVSS PR:L), then submit an oversized 'list' parameter to the /goform/setPptpUserList endpoint handled by formSetPPTPUserList. Practical exploitation is limited by: (1) the need for valid credentials, and (2) network reachability - the management interface is normally LAN-only, so remote (WAN) exploitation realistically requires remote management to be enabled or the device to be internet-exposed. Affected firmware is specifically version 16.03.08.12 of the AC20.
Impact	This is a moderate-priority issue rather than a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack that requires low-privilege authentication (PR:L) and no user interaction, with high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H) but no scope change to subsequent systems. A publicly available exploit exists, which raises real-world risk, and the EPSS score of 3.33% (88th percentile) is elevated relative to the average CVE - consistent with a public POC existing - but still indicates exploitation is not yet widespread. There is no CISA KEV listing, so there is no confirmed active exploitation. The key tension to flag: CVSS marks this AV:N (network), but as a SOHO router httpd flaw it is typically only reachable from the LAN unless remote WAN management is explicitly enabled, so the practical attack surface is usually local-network - verify whether remote management is exposed. Also note PR:L means valid (if low-privilege) credentials are required, which meaningfully limits mass exploitation versus a fully unauthenticated flaw. Net: a credible, POC-backed memory-corruption bug worth patching on exposed devices, but not a confirmed in-the-wild mass-exploitation event.
Exploit ScenarioDerived	An attacker with low-privilege access to the Tenda AC20 web interface (or on the same LAN, or via an exposed remote-management port) sends a crafted POST request to /goform/setPptpUserList with an oversized 'list' argument. The request overflows a stack buffer in the formSetPPTPUserList function of httpd, allowing the attacker to crash the service or potentially execute arbitrary code on the router. A public exploit for this exact endpoint is available on GitHub, lowering the skill barrier.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 3.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 07, 2026

A stack-based buffer overflow in the httpd component of Tenda AC20 firmware 16.03.08.12 allows a remote attacker to overwrite memory on the stack by submitting an oversized 'list' argument to the /goform/setPptpUserList endpoint, which is processed by the formSetPPTPUserList function. Based on the CVSS vector the attacker must first authenticate with at least low-privilege credentials (PR:L) and be able to reach the device's web-management interface, which is normally confined to the LAN unless remote management is enabled or the router is directly exposed. Publicly available exploit code exists (a public write-up with proof-of-concept is linked from the NVD references), and EPSS assigns a 3.33% exploitation likelihood (88th percentile), but there is no confirmed active exploitation (CISA KEV) and no vendor-released patch identified at the time of analysis.

RemediationAI

No vendor-released patch was identified at the time of analysis: the only vendor reference is the generic Tenda site (https://www.tenda.com.cn/), and the coordinated disclosures via VulDB (https://vuldb.com/?id.336387) carry no fixed version, so administrators should check Tenda's support pages for the AC20 for a firmware update newer than 16.03.08.12 and apply it immediately if one appears. Until then, the highest-value compensating control is to remove the attack surface: keep the AC20 web-management interface strictly LAN-side, disable remote/WAN management and any cloud or UPnP-based admin exposure so that only locally connected clients can reach the httpd goform handlers - the trade-off is that you lose convenience access from outside the home/office network, and any existing remote-management workflow must be replaced by VPN or equivalent. Second, eliminate the authentication prerequisite by rotating the admin password away from default/weak values (the vector requires PR:L, so valid credentials are needed before the overflow can be triggered) and restricting which LAN users can reach the administrative UI; note this only raises the bar and does not fix the underlying overflow. Third, monitor and log access to /goform/setPptpUserList and treat any unusually large 'list' parameter as hostile, since the public PoC at https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN12/AC20_SetPptpUserList.md demonstrates the trigger. If the AC20 cannot be kept off untrusted networks and no fixed firmware materializes, replacing the device is the only fully reliable mitigation. Do not rely on the absence of a CISA KEV entry as evidence of safety given the availability of public exploit code.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The Tenda AC20 is a consumer wireless router, and the vulnerable code lives in its embedded httpd web-management daemon, which exposes goform handlers such as /goform/setPptpUserList. The handler formSetPPTPUserList copies a user-supplied 'list' parameter into a fixed-size stack buffer without validating its length - the classic root cause under CWE-119 (improper restriction of operations within the bounds of a memory buffer), which in this instance manifests as a stack-based buffer overflow (CWE-121). Because the overflow occurs on the stack, controlled oversized input can corrupt adjacent stack memory such as saved registers and the return address, potentially yielding arbitrary code execution in the context of the httpd process. The affected build is identified by CPE cpe:2.3:o:tenda:ac20_firmware:16.03.08.12, i.e. firmware version 16.03.08.12 specifically. Note that the CVSS 4.0 vector supplied by the reporter scores 7.4 with PR:L, meaning the endpoint is reachable after authentication, and the vendor's own advisory channel referenced in the data is only the corporate site (https://www.tenda.com.cn/), with third-party coordination via VulDB (CTI ID 336387, submission 712899).

Know when Ac20 Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vuldb) PRIMARY 7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

vuln.today AI 8.8 HIGH

Network-reachable httpd endpoint (AV:N), trivial oversized-parameter trigger (AC:L), but valid low-privilege web credentials are required (PR:L); memory corruption yields full code-execution impact (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

A vulnerability was identified in Tenda AC20 16.03.08.12. The affected element is the function formSetPPTPUserList of the file /goform/setPptpUserList of the component httpd. Such manipulation of the argument list leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.

Executive ViewAI

Why It Matters

Tenda AC20 routers running firmware 16.03.08.12 contain a high-severity vulnerability that allows an authenticated, low-privilege attacker with access to the web management interface to corrupt memory and potentially take control of the device. Public exploit code is available and no vendor-released patch has been identified at the time of analysis, leaving organizations that use these routers-especially those with remote management enabled or exposed to untrusted networks-at risk of network compromise, lateral movement, and data exposure. Leadership should prioritize inventorying affected devices and applying interim mitigations until a patch is available.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis; interim mitigations include disabling remote management, restricting web interface access to trusted IPs, enforcing strong authentication, network segmentation, and monitoring for exploitation attempts.

Threat Intelligence Overview

EPSS Score

3.3%

Top 12% exploitable

Prevalence

Low

specific consumer/SOHO Tenda router model, no enterprise footprint

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 3.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +3

CVSS: +37

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.