Is there a public PoC exploit available for CVE-2025-15254?

Yes, a public proof-of-concept exploit is available for CVE-2025-15254. Prioritise patching immediately. EPSS: 0.9%.

Tenda W6-S CVE-2025-15254

Q: What is the CVSS score of CVE-2025-15254?

CVE-2025-15254 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

LOW

Command Injection (CWE-77)

2025-12-30 cna@vuldb.com

Command Injection Tenda W6 S Firmware

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

OS command injection grants full system control (C:H/I:H/A:H); PR:L reflects required authentication per CVSS 4.0 vector; S:C because router compromise affects downstream LAN.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:41 vuln.today

CVE Published

Dec 30, 2025 - 16:15 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability was found in Tenda W6-S 1.0.0.4(510). This affects the function TendaAte of the file /goform/ate of the component ATE Service. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used.

AnalysisAI

OS command injection in the Tenda W6-S wireless router firmware 1.0.0.4(510) allows a remote authenticated attacker to execute arbitrary operating system commands by sending crafted input to the TendaAte function via the /goform/ate endpoint of the ATE (Automatic Test Equipment) diagnostic service. A public proof-of-concept exploit exists on GitHub, raising practical risk despite the low official CVSS 4.0 score of 2.1. No active exploitation has been confirmed by CISA KEV, but EPSS places this at the 76th percentile, reflecting non-trivial exploitation likelihood given POC availability.

Technical ContextAI

The affected component is the ATE (Automatic Test Equipment) service, a diagnostic interface commonly embedded in consumer and SMB routers for factory testing purposes, exposed via the HTTP endpoint /goform/ate. The vulnerable function TendaAte fails to sanitize user-supplied input before passing it to an OS-level command interpreter, constituting a CWE-77 (Improper Neutralization of Special Elements used in a Command) flaw - the root cause is direct concatenation of untrusted data into a shell command string without escaping metacharacters. The affected product is identified via CPE cpe:2.3:o:tenda:w6-s_firmware:1.0.0.4(510):*:*:*:*:*:*:*, meaning only firmware version 1.0.0.4(510) is confirmed vulnerable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates the endpoint is network-reachable with low complexity and low-privilege authentication, consistent with an ATE service that may require basic session credentials but no elevated admin role.

RemediationAI

No vendor-released patch has been identified at time of analysis - the Tenda website is referenced but no advisory or updated firmware version was found. As a primary compensating control, restrict access to the router's web management interface (HTTP/HTTPS) to trusted LAN hosts only, and disable remote management if enabled; this prevents the /goform/ate endpoint from being reached over WAN. As a secondary control, change default credentials immediately to reduce the PR:L (low-privilege) authentication barrier. If the ATE diagnostic service can be disabled via router settings without breaking core functionality, do so - this removes the vulnerable attack surface entirely, though this option may not be exposed in the UI. Monitor for updated firmware from https://www.tenda.com.cn/ and apply it immediately upon release. Organizations with Tenda W6-S units in managed environments should consider replacing the device with actively supported hardware given the lack of a vendor response.