CVE-2025-15254
Published: 30 December 2025
Summary
CVE-2025-15254 is a medium-severity Command Injection (CWE-77) vulnerability in Tenda W6-S Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 22.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OS command injection vulnerability by requiring validation and sanitization of inputs to the TendaAte function in /goform/ate.
Mandates timely flaw remediation through firmware patching to eliminate the command injection vulnerability in Tenda W6-S 1.0.0.4(510).
Enforces least privilege to limit the scope and impact of arbitrary OS commands executed via the low-privilege remote access exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables exploitation of public-facing web application (router firmware) via command injection, directly facilitating Network Device CLI abuse for arbitrary OS command execution.
NVD Description
A vulnerability was found in Tenda W6-S 1.0.0.4(510). This affects the function TendaAte of the file /goform/ate of the component ATE Service. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been…
more
made public and could be used.
Deeper analysisAI
CVE-2025-15254 is an OS command injection vulnerability (CWE-77, CWE-78) discovered in Tenda W6-S router firmware version 1.0.0.4(510), published on 2025-12-30. The issue resides in the TendaAte function of the /goform/ate file within the ATE Service component, where manipulation leads to arbitrary command execution.
The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating exploitation over the network with low complexity, requiring low privileges but no user interaction. A remote attacker with such access can inject OS commands, potentially resulting in limited impacts to confidentiality, integrity, and availability.
Advisories and related resources, including VulDB entries (ctiid.338644, id.338644, submit.725499) and a GitHub repository detailing the exploit at github.com/dwBruijn/CVEs/blob/main/Tenda/ate.md, provide further technical details. The manufacturer's site at tenda.com.cn may offer patch information, though specifics are not detailed in the CVE description.
The exploit has been made public and could be used, increasing the risk for unpatched Tenda W6-S devices.
Details
- CWE(s)