CVE-2025-10442
Published: 15 September 2025
Summary
CVE-2025-10442 is a medium-severity Command Injection (CWE-77) vulnerability in Tenda Ac9 Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 28.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection via remote web endpoint (public-facing application) enables T1190 (Exploit Public-Facing Application), facilitates network device command execution (T1059.008), and indirect command execution (T1202, as cited in advisory).
NVD Description
A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14. This affects the function formexeCommand of the file /goform/exeCommand. This manipulation of the argument cmdinput causes os command injection. Remote exploitation of the attack is possible. The exploit has been…
more
publicly disclosed and may be utilized.
Deeper analysisAI
CVE-2025-10442 is an OS command injection vulnerability in Tenda AC9 and AC15 routers running firmware version 15.03.05.14. The flaw affects the formexeCommand function in the /goform/exeCommand file, where manipulation of the cmdinput argument enables arbitrary OS command execution. Published on 2025-09-15, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and maps to CWE-77 and CWE-78.
Remote attackers can exploit this vulnerability over the network with low complexity, provided they possess low privileges such as authenticated access. No user interaction is required, and exploitation remains confined to the affected component. Attackers can achieve limited impacts, including partial disclosure of sensitive information, modification of data or settings, and denial of service.
Advisories and references, including proof-of-concept details, are documented on GitHub at paths like /2664521593/mycve/blob/main/Tenda/Tenda_AC9_CJ.md and VulDB entries such as ctiid.323876 and id.323876. The exploit has been publicly disclosed and may be utilized by attackers.
Details
- CWE(s)