CVE-2025-15254
Published: 30 December 2025
Summary
CVE-2025-15254 is a medium-severity Command Injection (CWE-77) vulnerability in Tenda W6-S Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 13.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-15254 is an OS command injection vulnerability (CWE-77, CWE-78) discovered in Tenda W6-S router firmware version 1.0.0.4(510), published on 2025-12-30. The issue resides in the TendaAte function of the /goform/ate file within the ATE Service component, where manipulation leads to arbitrary command execution.
The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating exploitation over the network with low complexity, requiring low privileges but no user interaction. A remote attacker with such access can inject OS commands, potentially resulting in limited impacts to confidentiality, integrity, and availability.
Advisories and related resources, including VulDB entries (ctiid.338644, id.338644, submit.725499) and a GitHub repository detailing the exploit at github.com/dwBruijn/CVEs/blob/main/Tenda/ate.md, provide further technical details. The manufacturer's site at tenda.com.cn may offer patch information, though specifics are not detailed in the CVE description.
The exploit has been made public and could be used, increasing the risk for unpatched Tenda W6-S devices.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-205784
Vulnerability details
A vulnerability was found in Tenda W6-S 1.0.0.4(510). This affects the function TendaAte of the file /goform/ate of the component ATE Service. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been…
more
made public and could be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables exploitation of public-facing web application (router firmware) via command injection, directly facilitating Network Device CLI abuse for arbitrary OS command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents OS command injection vulnerability by requiring validation and sanitization of inputs to the TendaAte function in /goform/ate.
Mandates timely flaw remediation through firmware patching to eliminate the command injection vulnerability in Tenda W6-S 1.0.0.4(510).
Enforces least privilege to limit the scope and impact of arbitrary OS commands executed via the low-privilege remote access exploitation.