CVE-2025-1819
Published: 02 March 2025
Summary
CVE-2025-1819 is a medium-severity Command Injection (CWE-77) vulnerability in Tenda Ac7 Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 27.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the OS command injection flaw in the TendaTelnet function by applying firmware patches or updates.
Validates and sanitizes the lan_ip input parameter to block command injection manipulations in the /goform/telnet endpoint.
Scans systems for the specific CVE-2025-1819 vulnerability in Tenda AC7 firmware to identify exploitable routers.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct OS command injection in public-facing router web form (/goform/telnet) enables remote exploitation of the device (T1190) and arbitrary command execution via its CLI (T1059.008).
NVD Description
A vulnerability, which was classified as critical, was found in Tenda AC7 1200M 15.03.06.44. Affected is the function TendaTelnet of the file /goform/telnet. The manipulation of the argument lan_ip leads to os command injection. It is possible to launch the…
more
attack remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-1819 is a critical vulnerability in Tenda AC7 1200M routers running firmware version 15.03.06.44. It affects the TendaTelnet function within the /goform/telnet file, where manipulation of the lan_ip argument enables OS command injection, classified under CWEs-77 and CWE-78.
The vulnerability allows remote exploitation (AV:N) with low attack complexity (AC:L) by users possessing low privileges (PR:L), requiring no user interaction (UI:N) and maintaining unchanged scope (S:U). Successful attacks result in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L), yielding a CVSS v3.1 base score of 6.3.
Advisories reference a GitHub repository containing the disclosed exploit for Tenda AC7 V15.03.06.44 command injection, along with VulDB entries at ctiid.298092, id.298092, and submit.504429, plus the official Tenda website at tenda.com.cn. The exploit has been publicly disclosed and may be used.
Details
- CWE(s)