CVE-2025-32010 is a high severity (CVSS 8.1) stack based buffer overflow in the Cloud API of the Tenda AC6 V5.0 router, firmware V02.03.01.110. A crafted HTTP response can lead to code execution. No fixed firmware is named, so check Tenda and Talos TALOS-2025-2168.
What's affected
The NVD record names the Tenda AC6 V5.0 with firmware V02.03.01.110. The flaw is in the Cloud API functionality. The weakness class is CWE-121 (stack based buffer overflow).
The record says a specially crafted HTTP response can lead to arbitrary code execution, and that an attacker can send such a response to trigger the issue. Note the direction: the dangerous data is a response the router receives, not a request sent to its web page. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Attack complexity is high, which is why the score sits at 8.1 and not near 10.
The record lists no fixed firmware version. The Talos advisory is the primary source, and it was behind a bot check when I tried to fetch it, so I could not confirm remediation details from it.
How to check if you're exposed
- Identify the model and hardware revision on the label of the device. The record is specific to AC6 V5.0.
- Log in to the router admin page and read the firmware version. Compare it with V02.03.01.110.
- Check whether the cloud management feature is enabled. The record ties the flaw to the Cloud API, so a device that does not use that feature has less to worry about, though you should still confirm with the vendor.
- Open the Talos report TALOS-2025-2168 in a browser for the details Talos published.
If you manage many small office devices, keep a simple list of model, revision and firmware, since these devices rarely appear in software inventories.
What to do now
- Check the Tenda support site for firmware newer than V02.03.01.110 and install it if one exists. The advisory should be checked, because the record does not name a fixed build.
- Turn off cloud management features that you do not use.
- Make sure the router admin interface is not exposed to the internet.
- Replace the device if the vendor offers no update and it sits in a sensitive network.
- Segment guest and IoT devices away from systems that hold business data.
The free in-browser dependency scan takes a manifest or lockfile and lists known CVEs for the packages in it, and the Gold directory lets you look up a CVE by id.
Why it matters
Stack overflows are a classic memory safety flaw. A program copies data into a fixed size buffer on the stack without checking its length, and the extra bytes overwrite nearby memory, including control data. On embedded devices that often means the attacker controls what the router does next.
Routers matter more than their price suggests. They sit on the edge of the network and see all traffic, and they seldom get updates. A flaw that is triggered through a response the device fetches, rather than a request to it, is harder to filter with a simple firewall rule.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a fixed firmware available?
The record does not say. Check the Tenda support pages and Talos report TALOS-2025-2168.
Is it exploited in the wild?
No source reviewed says so, and the CISA KEV flag is false.
Sources
- Gold entry for CVE-2025-32010
- Talos report TALOS-2025-2168, listed in the NVD record. It blocked an automated fetch, so open it in a browser.
Last reviewed: 19 October 2026.
