CVE-2025-25675 is a critical (CVSS 9.8) command injection in the Tenda AC10, firmware V1.0 V15.03.06.23. The record lists no fixed version. Check Tenda's support page for new firmware, turn off remote administration, and replace the device if it no longer receives updates.
What's affected
- Product: Tenda AC10 router or access point and its firmware.
- Affected: firmware V1.0 V15.03.06.23, as named in the record. Other builds may share the code, so do not assume a newer or older build is safe without checking the vendor.
- Fixed: the record names no fixed version. Check the vendor's download page, and read any release notes before you flash.
- Detail: the formexeCommand function takes the cmdinput value from a POST request and passes it to a system command runner (doSystemCmd).
- Vector: network reachable, no login and no user interaction, which is how it reaches 9.8.
How to check if you're exposed
Find the firmware version in the router's admin page, usually under a system status or firmware upgrade menu. Menu names differ by model, so use the vendor's manual if you cannot find it. Compare the version string with V1.0 V15.03.06.23.
Then check whether the admin interface is reachable from the wrong places. From a machine outside your network, scan only your own public address.
nmap -Pn -p 80,443,8080 <your-public-ip>
Also check the router's settings for remote management, port forwarding and UPnP rules. If the web interface answers from the internet, treat the device as exposed. Look at the device logs if it keeps any, and for unexpected reboots or changed settings, which can indicate someone tried to use a flaw like this.
At a larger site, build a list of every Tenda device with its model and firmware so you know how many are affected.
What to do now
- Check Tenda's support or download page for firmware newer than V1.0 V15.03.06.23 for the AC10, and read its release notes before you flash.
- Turn off remote administration and make sure no port forward or UPnP rule exposes the web interface.
- Restrict the admin page to a small set of trusted internal addresses, and change the admin password to a long unique one.
- Keep guests and untrusted devices on a separate network from the one that can reach the admin interface.
- If no update exists or the product is out of support, plan to replace the device with a model that still receives security fixes.
- If the device was exposed to the internet, check its settings for changes you did not make, reset it to factory defaults and reconfigure it from scratch.
Why it matters
The class is command injection. A request value is placed into a string that the device then passes to a system command runner, so special characters in the value can change what command runs.
- CWE-77 is improper neutralization of special elements in a command, the general form of command injection.
- CWE-94 is improper control of code generation. The application builds or evaluates code from input it does not fully control.
The record also tags CWE-94, code injection, which fits the same behaviour of running attacker influenced input. The effect on the device is command execution on the device, typically with the privileges of the web service. Consumer and small office routers sit at the network edge and see every connection in and out, which makes a compromise valuable. They also tend to run old firmware for years because nobody owns the update task.
The published writeup is by an independent researcher, and the record does not say the vendor has responded. Tenda sells many models on shared codebases, so a bug in one build often points to the same pattern elsewhere. Reduce exposure first. The router's web interface should never face the internet, and the update question should be on your inventory.
Quick check
Is there a patched firmware for CVE-2025-25675?
The record names no fixed version. Check Tenda's support page for the AC10, and replace the device if it no longer receives updates.
Is this the same function as CVE-2025-25343?
The function name formexeCommand matches the AC6 record, but that one is a buffer overflow and this one is command injection, on a different model. They are separate bugs.
Sources
Last reviewed: 19 October 2026.
