CVE-2025-5629 is a high severity buffer overflow flaw (CVSS 8.8) in Tenda AC10 firmware up to 15.03.06.47. It is reachable over the network and needs a low privilege account. No fixed version is named in the record, so isolate the product, restrict access and check the vendor for an update.
What's affected
The record lists Tenda AC10 firmware up to 15.03.06.47. The affected code is the function formSetPPTPServer in /goform/SetPptpServerCfg (HTTP Handler component), and the argument startIp and endIp is the one the flaw depends on.
The NVD description was published on 2025-06-05. NVD rates it HIGH with a base score of 8.8. The vector shows attack complexity low, no user interaction, and impact of confidentiality high, integrity high, availability high.
Fixed versions: not stated in the record or in the pages we could read. We cannot confirm a patched release, so the vendor's advisory page or support channel should be checked directly. Do not assume a later version number is safe without a vendor statement.
The record also says the exploit has been disclosed to the public and may be used. It is not marked as exploited in the wild: the CISA Known Exploited Vulnerabilities flag in the record is false.
How to check if you're exposed
Log in to the device's web interface and read the firmware version on the status or system page. The record names firmware up to 15.03.06.47. Compare the model name too, since this CVE is specific to the Tenda AC10 Router.
Then check whether remote management is enabled. From a machine outside your network, the router's web management port should not answer. If it does, turn remote administration off in the device settings. If you cannot find the setting, the vendor's support site is the place to ask.
What to do now
- List every Tenda AC10 Router in use and its firmware version.
- Turn off remote administration and remove port forwards to the management interface.
- Check the vendor's download and support pages for firmware newer than the version in the record. None is named, so confirm the fix with the vendor.
- Restrict the web interface to a trusted wired segment, and change the administrator password if it is shared or old.
- After any firmware update, check the version again and confirm remote management is still off.
- If the vendor offers no fix, plan to replace the unit.
Why it matters
This is a buffer overflow. The classes are CWE-119 (improper restriction of operations within the bounds of a memory buffer); CWE-120 (a classic buffer copy without checking the size of the input). The firmware copies the value of startIp and endIp from a web request into a fixed size stack area without checking its length. Too much data overwrites neighbouring memory.
The base score of 8.8 reflects that it can be reached over the network with a low privilege account. Routers have little exploit mitigation compared with a modern server, so memory corruption bugs in their web handlers often lead to a crash at best and loss of control at worst. The record does not say which outcome applies here.
Router management pages should never face the internet. If remote administration is off and the interface is limited to a trusted segment, the practical risk drops a great deal, though a firmware fix is still the real answer.
Quick check
Does turning off remote administration remove the risk?
It removes the internet facing path, which matters most. Anyone on the local network may still reach the web interface, so keep that segment trusted.
Is there a firmware fix?
The record does not name one. Check the vendor's support site and confirm the version in writing if you can.
Sources
Check your own dependencies with the free in-browser scan at gold.safeguard.sh/scan. It reads manifests you give it, so it will not see a router or a standalone server, but it is a quick way to cover the code you ship.
Last reviewed: 18 October 2026.
