What is the CVSS score of CVE-2025-5849?

CVE-2025-5849 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Ac15 Firmware are affected by CVE-2025-5849?

A critical remote code execution vulnerability affects Tenda AC15 routers (version 15.03.05.19_multi) with a public exploit available, potentially allowing attackers to compromise network…

Is there a public PoC exploit available for CVE-2025-5849?

Yes, a public proof-of-concept exploit is available for CVE-2025-5849. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-5849?

Within 24 hours: Identify and inventory all Tenda AC15 devices in production environments and assess exposure to untrusted networks. Within 7 days: Implement network segmentation to isolate affected devices and restrict HTTP POST access to the /goform/SetRemoteWebCfg endpoint; disable remote web management features if not operationally critical. Within 30 days: Develop a device replacement strategy with IT procurement and plan migration to patched alternative router models; monitor Tenda security advisories for patch availability.

Ac15 Firmware CVE-2025-5849

EUVD-2025-17415 HIGH

Buffer Overflow (CWE-119)

2025-06-08 cna@vuldb.com

Buffer Overflow Ac15 Firmware Tenda

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:17 euvd

EUVD-2025-17415

Analysis Generated

Mar 14, 2026 - 19:17 vuln.today

PoC Detected

Jun 09, 2025 - 19:04 vuln.today

Public exploit code

CVE Published

Jun 08, 2025 - 23:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in Tenda AC15 15.03.05.19_multi. It has been classified as critical. This affects the function formSetSafeWanWebMan of the file /goform/SetRemoteWebCfg of the component HTTP POST Request Handler. The manipulation of the argument remoteIp leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.