CVE-2025-4298 is a high severity (CVSS 8.8) buffer overflow in the Tenda AC1206 router, firmware up to 15.03.06.23. The formSetCfm function behind the setcfm web handler can be overrun remotely. The record lists no fixed firmware, so check Tenda's site and limit access to the router's admin interface.
What's affected
Tenda AC1206 firmware up to and including 15.03.06.23, per the record. The vulnerable function is formSetCfm, which serves requests to /goform/setcfm on the router's web management service. The CVE text says the manipulation leads to a buffer overflow and that the attack can be initiated remotely.
The weaknesses are tagged CWE-119 and CWE-120, both memory safety classes. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: network reachable, low complexity, and low privileges required, so the scoring assumes the attacker has at least a basic login, with high impact on confidentiality, integrity and availability.
The record does not name a fixed firmware version. The vendor's site is listed as a reference, but I could not confirm a patch from it. Check the Tenda support page for your exact hardware revision.
How to check if you're exposed
On a Tenda AC1206, log in to the web interface and open the system status or firmware page. The firmware version is shown there. Compare it with 15.03.06.23. Anything at or below that value is in the affected range.
Then check whether the management page is reachable from outside your network. From a device that is not on your LAN, test the router's public address on the management port. If you can reach the login page, remote administration is on.
Also check the router's own settings for a remote management or WAN access option, and note whether it is enabled.
What to do now
- Find every Tenda AC1206 in use, including branch offices and staff home setups that connect to your resources.
- Check Tenda's support site for a firmware newer than 15.03.06.23, and apply it if one exists.
- Turn off remote management so the admin interface is reachable only from the local network.
- Change the admin password to a long unique one, since the score assumes an attacker who can reach the interface.
- Keep guest and IoT devices on a separate network from the one that can reach the router's admin page.
- If the model is end of support and no fix appears, plan its replacement.
Try it yourself
This demo walks through a vulnerability management, the kind of step that helps with findings like this one.
Click through it at your own pace, or open it full screen.
Why it matters
Home and small office routers sit at the edge of a network and rarely get patched. A memory safety bug in the web management code turns an admin page into a way to crash the device or, in the worst case, take it over. The record does not describe the outcome in that detail.
The record says the exploit has been disclosed to the public and may be used. It does not flag the CVE as listed in CISA's Known Exploited Vulnerabilities catalog (KEV), so there is no confirmation of attacks in the wild. A router bug with a public exploit still draws scanning, so removing internet exposure is the best first step.
Quick check
Which Tenda models are affected?
The record names the Tenda AC1206, firmware up to 15.03.06.23. Other Tenda models are not listed here, so check Tenda's own advisories for them.
Is there a fixed firmware?
The record does not list one. Check the Tenda support page for your hardware revision and apply any newer release.
Sources
- Gold entry for CVE-2025-4298
- Gold entry for CWE-119
- Gold entry for CWE-120
- Tenda website, listed in the CVE record
- VulDB entry, listed in the CVE record
The reference pages above are linked from the CVE record. Some block automated access, so I could not read their full text.
Last reviewed: 18 October 2026.
