What is the CVSS score of CVE-2025-7544?

CVE-2025-7544 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Ac1206 Firmware are affected by CVE-2025-7544?

A critical remote code execution vulnerability affecting Tenda AC1206 routers has been publicly disclosed with working exploits available.

Is there a public PoC exploit available for CVE-2025-7544?

Yes, a public proof-of-concept exploit is available for CVE-2025-7544. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2025-7544?

Within 24 hours: Identify all Tenda AC1206 devices running firmware 15.03.06.23 in your network and isolate affected units from critical infrastructure. Within 7 days: Implement network segmentation to restrict administrative access to these devices and enable enhanced logging on perimeter security controls. Within 30 days: Replace vulnerable Tenda AC1206 units with patched firmware (if available from vendor) or alternative vendors, or decommission the devices if replacement is not feasible.

Ac1206 Firmware CVE-2025-7544

EUVD-2025-21279 HIGH

Buffer Overflow (CWE-119)

2025-07-13 cna@vuldb.com

Buffer Overflow Tenda Ac1206 Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 09:18 euvd

EUVD-2025-21279

Analysis Generated

Mar 16, 2026 - 09:18 vuln.today

PoC Detected

Jul 16, 2025 - 14:36 vuln.today

Public exploit code

CVE Published

Jul 13, 2025 - 22:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in Tenda AC1206 15.03.06.23. It has been rated as critical. This issue affects the function formSetMacFilterCfg of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7544 is a critical stack-based buffer overflow vulnerability in Tenda AC1206 firmware version 15.03.06.23, specifically in the formSetMacFilterCfg function accessible via the /goform/setMacFilterCfg endpoint. An authenticated remote attacker can exploit this vulnerability by manipulating the deviceList parameter to achieve remote code execution with high confidentiality, integrity, and availability impact. Public exploit disclosure and active exploitation indicators elevate real-world risk significantly.

Technical ContextAI

The vulnerability exists in a web-accessible form handler (formSetMacFilterCfg) within Tenda's AC1206 wireless router firmware, classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The vulnerability stems from unsafe buffer handling in the deviceList parameter processing—the application fails to properly validate input length before copying data to a stack-allocated buffer, allowing attackers to overflow the buffer boundary. This is a classic stack-based buffer overflow affecting the router's firmware image version 15.03.06.23 (CPE: cpe:2.3:o:tenda:ac1206_firmware:15.03.06.23:*:*:*:*:*:*:*). The /goform/ endpoint pattern indicates a CGI-based web interface common in embedded router firmware.

RemediationAI

{'type': 'patch', 'description': 'Upgrade to a firmware version newer than 15.03.06.23 when available from Tenda', 'status': 'Patch status unknown—check Tenda support/downloads portal for AC1206 firmware updates', 'link': 'https://www.tenda.com.cn/ (check support section for AC1206 firmware downloads)'} {'type': 'workaround', 'description': 'Restrict network access to the /goform/setMacFilterCfg endpoint via firewall rules or WAF (web application firewall) if internal access is required', 'details': 'Block external access to port 80/443 where the web interface is hosted; implement access controls limiting who can authenticate to the router'} {'type': 'workaround', 'description': 'Disable remote management features and restrict router web interface access to LAN-only', 'details': 'Via router settings: disable WAN-side web management, disable UPnP port mapping for the web interface'} {'type': 'mitigation', 'description': 'Implement strong authentication controls and monitor router logs for suspicious /goform/setMacFilterCfg requests', 'details': 'Change default credentials; monitor for POST requests with large deviceList parameters'}