CVE-2025-11324

High

Description

A vulnerability was identified in Tenda AC18 15.03.05.19(6318). Affected by this vulnerability is an unknown functionality of the file /goform/setNotUpgrade. Such manipulation of the argument newVersion leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.

SeverityHigh

CVSS8.8

Exploit probability—

ProductTenda Ac18 Firmware

PublishedOct 6, 2025

First seenOct 6, 2025

Weakness typeCWE-121CWE-121 CWE-119Memory buffer bounds error

How to fix

Patches

github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/setNotUpgrade.md

Affected products

Product	Affected versions	Fixed in
tenda ac18_firmware	15.03.05.19\(6318\)	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.