CVE-2025-3346
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Apr 7, 2025
CWE ID 119
CWE ID 120
Summary
CVE-2025-3346 is a critical vulnerability affecting the Tenda AC7 firmware version 15.03.06.44. The issue lies in the function formSetPPTPServer of the file /goform/SetPptpServerCfg, which is susceptible to a buffer overflow. This vulnerability can be triggered by manipulating the arguments pptp_server_start_ip and pptp_server_end_ip. The consequences of this exploit can be severe, as it may be launched remotely. The existence and public disclosure of the exploit increase the risk for potential attacks.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Tenda AC7
Affected Vendors
- Shenzhen Tenda Technology Co. Ltd