What is the CVSS score of CVE-2025-70252?

CVE-2025-70252 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Ac6 Firmware are affected by CVE-2025-70252?

A high-severity vulnerability in Tenda AC6V2.0 wireless routers allows remote attackers to manipulate WiFi Protected Setup (WPS) functions through uncontrolled parameters, potentially leading to…

Is there a public PoC exploit available for CVE-2025-70252?

Yes, a public proof-of-concept exploit is available for CVE-2025-70252. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-70252?

Within 24 hours: Identify and inventory all Tenda AC6V2.0 devices running firmware V15.03.06.23_multi across the organization; disable WPS functionality on all affected devices immediately via administrative interfaces. Within 7 days: Evaluate network segmentation to isolate affected routers from critical systems; implement network access controls to restrict WPS-related traffic; document findings and mitigation status. Within 30 days: Monitor Tenda security advisories for patch availability; develop a device replacement or upgrade strategy; conduct network access audits to detect any unauthorized access attempts during the vulnerability window.

Ac6 Firmware CVE-2025-70252

HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-02 cve@mitre.org

Stack Overflow Tenda Ac6 Firmware

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 06, 2026 - 21:04 vuln.today

Public exploit code

CVE Published

Mar 02, 2026 - 17:16 nvd

HIGH 7.5

DescriptionCVE.org

An issue was discovered in /goform/WifiWpsStart in Tenda AC6V2.0 V15.03.06.23_multi. The index and mode are controllable. If the conditions are met to sprintf, they will be spliced into tmp. It is worth noting that there is no size check,which leads to a stack overflow vulnerability.

AnalysisAI

An issue was discovered in /goform/WifiWpsStart in Tenda AC6V2.0 V15.03.06.23_multi. The index and mode are controllable. [CVSS 7.5 HIGH]

Technical ContextAI

Classified as CWE-121 (Stack-based Buffer Overflow). Affects Ac6 Firmware. An issue was discovered in /goform/WifiWpsStart in Tenda AC6V2.0 V15.03.06.23_multi. The index and mode are controllable. If the conditions are met to sprintf, they will be spliced into tmp. It is worth noting that there is no size check,which leads to a stack overflow vulnerability.