CVE-2025-25507

Summary

CVE-2025-25507 is a newly disclosed remote code execution (RCE) vulnerability affecting Tenda AC6 devices running firmware version 15.03.05.16_multi. The issue is located in the formexeCommand function, where the cmdinput parameter can be manipulated to execute arbitrary commands remotely, posing a significant security risk. An attacker can exploit this vulnerability by sending specially crafted input to the affected device, gaining full control over it. Users are advised to update their firmware as soon as a patch becomes available to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.