What is the CVSS score of CVE-2025-14655?

CVE-2025-14655 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 3.3%.

Is there a public PoC exploit available for CVE-2025-14655?

Yes, a public proof-of-concept exploit is available for CVE-2025-14655. Prioritise patching immediately. EPSS: 3.3%.

How to fix or mitigate CVE-2025-14655?

Within 24 hours, inventory all Tenda AC20 devices and identify any running firmware 16.03.08.12; immediately remove public or untrusted-network access to the web management interface, including the /goform/SetSysAutoRebbotCfg handler, disable remote management where possible, and restrict administration to a trusted management VLAN or local console. Within 7 days, verify authentication requirements for CVE-2025-14655 because the CVSS vector indicates low-privilege authentication (PR:L) while the advisory notes authentication prerequisites are not confirmed; change default credentials, enforce strong unique admin passwords, add firewall/IDS/WAF rules to detect or block crafted rebootTime requests to /goform/SetSysAutoRebbotCfg, and check the vendor for updated firmware or advisories since no vendor-released patch identified at time of analysis. Within 30 days, if no vendor patch is available, develop a replacement or retirement plan for affected Tenda AC20 firmware 16.03.08.12 devices, isolate them from critical networks, re-scan after any vendor update, and deploy a tested vendor patch promptly if one is released.

Tenda AC20 CVE-2025-14655

HIGH

Buffer Overflow (CWE-119)

2025-12-14 cna@vuldb.com

Buffer Overflow Tenda Ac20 Firmware

7.4

CVSS 4.0 · Vendor: vuldb

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach router HTTP management interface
Delivery

Send crafted POST to /goform/SetSysAutoRebbotCfg
Exploit

Overflow stack buffer via rebootTime argument
Execution

Hijack control flow in httpd
Impact

Execute code / crash device on router

Vulnerability Assessment

Weakness	CWE CWE-119 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, buffer size validation MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires network access to the Tenda AC20 (firmware 16.03.08.12) HTTP management daemon (httpd) and the ability to issue a request to /goform/SetSysAutoRebbotCfg with an attacker-controlled rebootTime value. The vendor CVSS 4.0 vector indicates low-privilege authentication (PR:L) is needed, though the description does not explicitly confirm an auth requirement and this bug class is frequently pre-authentication on Tenda devices - verify against the firmware. No user interaction is required (UI:N). The main practical limit is exposure of the web management interface, which is normally LAN-only unless remote administration is enabled; the flaw is tied to this specific firmware build.
Impact	This is a stack-based buffer overflow (CWE-119) in the httpd formSetRebootTimer handler of the Tenda AC20 router, reachable via the /goform/SetSysAutoRebbotCfg endpoint by manipulating the rebootTime argument. Multiple risk signals point in the same elevated direction: the vendor CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:L/UI:N with high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H, score 7.4), and public exploit code is confirmed available (E:P in the 4.0 vector, plus a GitHub PoC reference). No EPSS score, SSVC decision data, or CISA KEV listing was provided, so there is no confirmation of active in-the-wild exploitation - this is a public-PoC, not-yet-confirmed-exploited issue. The realistic risk is meaningful: Tenda goform overflows in this firmware family are a well-worn, easily weaponizable class of bug on internet-adjacent SOHO devices, and a working PoC lowers the bar substantially. One caveat to verify: the CVSS 4.0 vector states PR:L (authenticated/low-privilege), yet the description only says the attack 'is possible to be carried out remotely' without confirming an authentication requirement - many Tenda /goform overflows are in practice pre-authentication, so the true privilege requirement should be verified against the firmware. The primary limiting factor is exposure: exploitation requires network reachability of the router's HTTP management interface, which is typically LAN-facing by default.
Exploit ScenarioDerived	An attacker with network access to the router's web management interface sends a crafted POST request to /goform/SetSysAutoRebbotCfg with an oversized rebootTime argument, overflowing a stack buffer in the httpd formSetRebootTimer function. This corrupts the stack to crash the daemon or achieve arbitrary code execution on the device (embedded MIPS/ARM Linux). Public exploit/PoC code for this exact endpoint is already released, making practical exploitation straightforward.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 3.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 30, 2026

Stack-based buffer overflow in the Tenda AC20 router running firmware 16.03.08.12 allows a remote attacker to overwrite stack memory by sending a crafted rebootTime value to the formSetRebootTimer handler behind /goform/SetSysAutoRebbotCfg, leading to a daemon crash and potential arbitrary code execution in the httpd process. Publicly available exploit code exists, so any unit whose web management interface is reachable from an untrusted network should be treated as at risk. The flaw carries a CVSS 4.0 base score of 7.4 with exploit maturity E:P; the supplied vector indicates low-privilege authentication (PR:L) and no user interaction, but authentication requirements are not confirmed by the description, and this bug class is frequently pre-authentication on Tenda devices, so the true prerequisite should be verified against the firmware.

RemediationAI

No vendor-released patch identified at time of analysis, and no fixed firmware version appears in the supplied references, so remediation must currently rely on exposure reduction. Disable remote/web administration from the WAN side and keep the httpd management interface bound to the trusted LAN only, enforced by an upstream firewall rule that blocks inbound TCP/80 and TCP/443 (or any custom management port) to the router - the trade-off is that legitimate remote administration then requires a VPN or SSH tunnel. Segment the router management plane onto an administrative VLAN or restrict it to specific source addresses, and change default administrative credentials, since the CVSS 4.0 vector's low-privilege authentication prerequisite (PR:L) means any low-privileged session may be enough to reach the vulnerable handler; note that this assessment flags the auth requirement as unverified and the endpoint may in fact be reachable pre-authentication, so network-level restriction matters more than credential hygiene here. Where the device must remain internet-facing, place it behind a reverse proxy or WAF rule that rejects requests to /goform/SetSysAutoRebbotCfg or drops rebootTime parameters exceeding expected length, and monitor httpd logs for oversized or malformed requests to that path as an exploitation signal. Because exploit code is public, consider replacing or upgrading the device if Tenda provides no firmware fix; monitor https://www.tenda.com.cn/ and the VULDB entry (https://vuldb.com/?id.336388) for a patched release, and apply the vendor firmware immediately once available.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is the httpd web management daemon in Tenda AC20 firmware 16.03.08.12, matched by CPE cpe:2.3:o:tenda:ac20_firmware:16.03.08.12:*:*:*:*:*:*:*. The vulnerable path is the goform endpoint /goform/SetSysAutoRebbotCfg, which is dispatched to the formSetRebootTimer function; that handler consumes the rebootTime argument and copies it into a fixed-size stack buffer without adequate length validation, producing a classic stack-based buffer overflow in the CWE-119 (improper restriction of operations within the bounds of a memory buffer) family. Because the overflow occurs on the stack, corrupted adjacent locals and saved registers/return addresses can redirect control flow within the httpd process, which on embedded router firmware typically runs with elevated privileges. The attacker needs only the ability to reach the HTTP management surface and submit a request with an oversized rebootTime value; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) describes high confidentiality, integrity and availability impact confined to the device itself, with no subsequent-system impact (SC:N/SI:N/SA:N). The independent assessment concurs with a CVSS 3.1 equivalent of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and notes that the practical limiting factor is exposure of the management interface, which is normally LAN-only unless remote administration has been enabled.

Know when Ac20 Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vuldb) PRIMARY 7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

vuln.today AI 8.8 HIGH

Network-reachable httpd endpoint with low complexity and no user interaction; PR:L follows the vendor vector (auth unconfirmed, could be PR:N), stack overflow yields full code-execution impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

A security flaw has been discovered in Tenda AC20 16.03.08.12. The impacted element is the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd. Performing a manipulation of the argument rebootTime results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

Executive ViewAI

Why It Matters

Tenda AC20 routers running firmware 16.03.08.12 are affected by a high-severity stack-based buffer overflow in the web management component, and publicly available exploit code exists; no vendor-released patch identified at time of analysis. Organizations with these devices exposed to untrusted networks face potential device crashes, service disruption, and possible code execution on the router, which can affect network availability and provide a foothold for further compromise. Leadership should prioritize identifying and isolating affected devices because the management interface may be reachable from broader networks and exploitation could disrupt connectivity or enable lateral movement.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: block or disable external and untrusted-network access to the Tenda AC20 web management interface, especially the /goform/SetSysAutoRebbotCfg path; disable remote management; restrict management access to a trusted VLAN or local console; change default credentials and enforce least privilege; segment affected routers from critical assets; monitor for httpd crashes, unexpected reboots, and requests containing crafted rebootTime values; replace or retire affected Tenda AC20 firmware 16.03.08.12 devices if they cannot be adequately isolated.

Threat Intelligence Overview

EPSS Score

3.3%

Top 12% exploitable

Prevalence

Low

single consumer SOHO router model, no enterprise footprint

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 3.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +3

CVSS: +37

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.