CVE•Published 2025-09-22•Modified 2026-10-11•1 article on news•7 live references•NVD data
CVE-2025-10815Tenda · Ac20_firmware
Vulnerability data via NVD (ingested)
CVSS v3.1
8.8
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS percentile
56
Exploit Prediction Scoring System · top 44% of all CVEs
Weaknesses (CWE)
Description
A vulnerability was identified in Tenda AC20 up to 16.03.08.12. Affected by this issue is the function strcpy of the file /goform/SetPptpServerCfg of the component HTTP POST Request Handler. Such manipulation of the argument startIp leads to buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used.
Timeline
Published 2025-09-22
Modified 2026-10-11
External references
Search for exposed instances
Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).
Shodan · vuln tag0 hosts
vuln:CVE-2025-10815Hosts Shodan has explicitly fingerprinted as vulnerable.
Shodan · OS
os:"Ac20 Firmware"Hosts Shodan identified as running Ac20 Firmware.
More intel sources (5)
Shodan report
vuln:CVE-2025-10815Country / ASN / product breakdown for the vuln query.
Censys
vulnerabilities.cve_id: CVE-2025-10815Censys host search filtered to this CVE id.
grep.app
CVE-2025-10815Public source-code mentions — fast PoC discovery.
GitHub code
CVE-2025-10815GitHub code search for direct mentions.
Google dork
"CVE-2025-10815" exploit -site:nvd.nist.govWrite-ups and news, NVD excluded.