CVE-2025-11388

High

Description

A vulnerability was identified in Tenda AC15 15.03.05.18. This impacts an unknown function of the file /goform/setNotUpgrade. Such manipulation of the argument newVersion leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used.

SeverityHigh

CVSS8.8

Exploit probability—

ProductTenda Ac15 Firmware

PublishedOct 7, 2025

First seenOct 7, 2025

Weakness typeCWE-121CWE-121 CWE-119Memory buffer bounds error

How to fix

Patches

github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC15/setNotUpgrade.md

Affected products

Product	Affected versions	Fixed in
tenda ac15_firmware	15.03.05.18	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.