CVE-2025-4896

🗓️ 18 May 2025 21:00:08Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 55 Views🌐 WEB

Critical vulnerability in Tenda AC10 allows remote buffer overflow via getuid manipulation.

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	The vulnerability of the /goform/UserCongratulationsExec file in the Tenda AC10 router microprogramming system allows a hacker to execute arbitrary code.	23 May 202500:00	–	bdu_fstec
Circl	CVE-2025-4896	18 May 202521:37	–	circl
CNNVD	Tenda AC10 安全漏洞	18 May 202500:00	–	cnnvd
CNVD	Tenda AC10 Buffer Overflow Vulnerability	22 May 202500:00	–	cnvd
Cvelist	CVE-2025-4896 Tenda AC10 UserCongratulationsExec buffer overflow	18 May 202521:00	–	cvelist
EUVD	EUVD-2025-15705	3 Oct 202520:07	–	euvd
NVD	CVE-2025-4896	18 May 202521:15	–	nvd
OSV	CVE-2025-4896	18 May 202521:15	–	osv
Positive Technologies	PT-2025-21864 · Tenda · Tenda Ac10	17 May 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-4896	20 May 202523:16	–	redhatcve

NVD

Vulners

Node

tenda ac10_firmwareMatch16.03.10.13

AND

tenda ac10Match-

[
  {
    "vendor": "Tenda",
    "product": "AC10",
    "versions": [
      {
        "version": "16.03.10.13",
        "status": "affected"
      }
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
tenda	www.tenda.com.cn/
vuldb	www.vuldb.com/
github	www.github.com/byxs0x0/cve2/blob/main/Tenda%20AC10.md

Parameter	Position	Path	Description	CWE
getuid	request body	/goform/UserCongratulationsExec	Buffer overflow via manipulated getuid argument on /goform/UserCongratulationsExec	CWE-119, CWE-120

17 Jun 2026 09:34Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.5 - 8.8

CVSS 48.7

CVSS 29

CVSS 38.8

EPSS0.00683

SSVC