CVE-2025-5606
Published: 04 June 2025
Summary
CVE-2025-5606 is a medium-severity Injection (CWE-74) vulnerability in Tenda Ac18 Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 7.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A vulnerability has been identified in the Tenda AC18 router running firmware version 15.03.05.05. The issue resides in the formSetIptv function within the /goform/SetIPTVCfg endpoint, where improper handling of the list argument enables command injection. The flaw is tracked under CVE-2025-5606, carries a CVSS v4 score of 5.3, and is associated with CWE-74 and CWE-77.
An authenticated attacker with network access can supply a crafted list parameter to the affected endpoint, resulting in arbitrary command execution on the device. Because the attack is remote and requires only low privileges without user interaction, an adversary who has obtained valid credentials or session access can leverage the flaw to run operating-system commands.
Public references include a detailed disclosure on a Notion page along with entries on VulDB that reproduce the injection vector, while the vendor site at tenda.com.cn provides no specific mitigation guidance in the available references. The EPSS score remains flat at 0.0812 with no observed increase after publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16911
Vulnerability details
A vulnerability was found in Tenda AC18 15.03.05.05. It has been declared as critical. This vulnerability affects the function formSetIptv of the file /goform/SetIPTVCfg. The manipulation of the argument list leads to command injection. The attack can be initiated remotely.…
more
The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.