What’s Vulnerable › Vulnerabilities

CVE-2025-10442: Tenda AC9/AC15 exeCommand formexeCommand os command injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 9.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-15 · updated 2026-10-18
• Weakness: CWE-77

Description

A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14. This affects the function formexeCommand of the file /goform/exeCommand. This manipulation of the argument cmdinput causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Affected products

• Tenda AC15: 15.03.05.14
• Tenda AC9: 15.03.05.14

References

• https://github.com/2664521593/mycve/blob/main/Tenda/Tenda_AC9_CJ.md
• https://github.com/2664521593/mycve/blob/main/Tenda/Tenda_AC9_CJ.md#poc
• https://vuldb.com/?ctiid.323876
• https://vuldb.com/?id.323876
• https://vuldb.com/?submit.647838
• https://vuldb.com/?submit.647839
• https://www.tenda.com.cn/

Get alerted when CVE-2025-10442 or the next vulnerability affects your stack