CVE-2025-1819 is a medium severity OS command injection flaw in Tenda AC7 1200M firmware 15.03.06.44, scored 6.3. Attacker supplied input reaches a system command. No fixed version is named, so check the vendor and limit exposure. The record says exploit details are public, and it is not on the CISA KEV list.
What's affected
The CVE record lists Tenda AC7 1200M firmware 15.03.06.44. The weakness sits in the TendaTelnet function behind /goform/telnet, through the lan_ip input.
- Product: Tenda AC7 1200M
- Affected: firmware 15.03.06.44
- Fixed: not named in the CVE record
- Severity: Medium, CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
- Known exploited (CISA KEV): no, the record's kev flag is false
The CVE record does not name a fixed version. The vendor advisory, if one exists, should be checked before you rely on any version number.
The record also says the exploit has been disclosed to the public and may be used. That is a statement about public technical details, not a statement that attacks are underway. KEV status is false, and nothing in the record claims in the wild exploitation.
How to check if you're exposed
This is network equipment, so there is no package to query. Work through it like this.
- Log in to the admin page and read the firmware version. Compare it with firmware 15.03.06.44 from the record.
- Check whether the web management interface answers on any address outside your trusted LAN, including the WAN side and any port forward.
- Look at the device's own logs or your gateway logs for unexpected requests to the management paths named above.
If your inventory is a spreadsheet, filter it for this model first. Most teams find a few of these devices they had forgotten about.
What to do now
- Inventory every Tenda AC7 1200M you run and note the version.
- Remove management access from the internet. Turn off remote administration and delete port forwards that point at the admin interface.
- Limit the admin interface to a trusted management network or VPN, and use a strong unique admin password.
- Watch the vendor support page for firmware or a patch. The record names no fixed version, so check the advisory before assuming one exists.
- If the device cannot be isolated and no fix appears, plan its replacement. Unsupported network gear is a standing risk.
- Review gateway logs for requests to the affected path and for odd outbound connections from the device.
Why it matters
The weakness is command injection. The application builds a command for the operating system and includes a value the user controls, here lan_ip, without neutralising characters that the shell treats as special. The command then does more than its author intended.
Impact depends on where the code runs. On a router or similar device the process often has wide rights, so a successful abuse can change settings, read stored credentials or pivot to other hosts. The record scores confidentiality, integrity and availability impact as low each, and says the attack needs a low privileged account (PR:L in the vector). Treat the score as a floor for the planning of exposed gear, not a ceiling.
The record maps this to CWE-77 (Improper Neutralization of Special Elements used in a Command), CWE-78 (OS Command Injection).
Quick check
Is CVE-2025-1819 exploited in the wild?
The record's CISA KEV flag is false, and nothing in the record says attacks are underway. It does say the exploit has been disclosed to the public, so assume the technical details are available.
Is there a patch for Tenda AC7 1200M?
The CVE record names no fixed version. Check the vendor support page and advisory, and reduce exposure of the management interface in the meantime.
Sources
- Safeguard Gold entry for CVE-2025-1819
- CVE record data as supplied for this review (NVD description, CVSS vector, CWE list). The references below are listed in the record and were not all fetched for this page, so confirm details against the vendor before acting.
- https://github.com/Raining-101/IOT_cve/blob/main/Tenda%20a7%20V15.03.06.44%20Command%20injection.md
- https://vuldb.com/?ctiid.298092
- https://vuldb.com/?id.298092
- https://vuldb.com/?submit.504429
- https://www.tenda.com.cn/
Last reviewed: 19 October 2026.
