CVE-2025-70252: tenda ac6_firmware Stack-based Buffer Overflow
Vulnerability summary
CVE-2025-70252 is a high (CVSS 7.5) Stack-based Buffer Overflow vulnerability in tenda ac6_firmware. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 40% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 02-03-2026PublishedVulnerability first disclosed.
- 03-03-2026Last modifiedVulnerability information updated.
Description
An issue was discovered in /goform/WifiWpsStart in Tenda AC6V2.0 V15.03.06.23_multi. The index and mode are controllable. If the conditions are met to sprintf, they will be spliced into tmp. It is worth noting that there is no size check,which leads to a stack overflow vulnerability.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
Increase +0.03 pp
From 0.45% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundCvereport
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Tenda1 product
- ac6_firmware15.03.06.23_multi
1 vendor · 1 product