cbcvebase.
CVE-2025-15356
published 2025-12-30

CVE-2025-15356: A vulnerability has been found in Tenda AC20 up to 16.03.08.12. The impacted element is the function sscanf of the file /goform/PowerSaveSet. The manipulation…

PriorityP269high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
3.45%
87.7th percentile
A vulnerability has been found in Tenda AC20 up to 16.03.08.12. The impacted element is the function sscanf of the file /goform/PowerSaveSet. The manipulation of the argument powerSavingEn/time/powerSaveDelay/ledCloseType leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected

14 ranges
VendorProductVersion rangeFixed in
tendaac20——
tendaac20——
tendaac20——
tendaac20——
tendaac20——
tendaac20——
tendaac20——
tendaac20——
tendaac20——
tendaac20——
tendaac20——
tendaac20——
tendaac20——
tendaac20_firmware<= 16.03.08.12—

Detection & IOCsextracted from sources · hover to see the quote

url/goform/PowerSaveSet↗
path/goform/PowerSaveSet↗
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Tenda PowerSaveSet time Parameter Buffer Overflow Attempt (CVE-2025-15356)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:20; content:"/goform/PowerSaveSet"; fast_pattern; http.request_body; content:"time|3d|"; pcre:"/^[^&]{100,}(?:&|$)/R"; reference:url,github.com/xyh4ck/iot_poc/blob/main/Tenda%20AC23_Buffer_Overflow/Tenda%20AC23_Buffer_Overflow.md#poc; reference:cve,2025-15356; classtype:web-application-attack; sid:2066607; rev:1; metadata:affected_product Tenda, attack_target Networking_Equipment, tls_state plaintext, created_at 2026_01_07, cve CVE_2025_15356, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2026_01_07, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
  • →Look for HTTP POST requests to /goform/PowerSaveSet with a 'time' parameter value exceeding 100 characters (buffer overflow attempt via oversized input).
  • →The vulnerable parameters are powerSavingEn, time, powerSaveDelay, and ledCloseType — all passed to sscanf without bounds checking. Monitor for abnormally long values in any of these POST body fields.
  • →Attack is remotely initiated over plaintext HTTP (not TLS); deploy detection at the network perimeter and internally.
  • →The Snort/Suricata SID for this rule is 2066607 (ET, rev:1); use this to track or suppress the signature in your SIEM/IDS.
  • ·Affected firmware is Tenda AC20 up to version 16.03.08.12; ensure version scoping is applied when deploying detections to avoid false positives on unaffected devices. ↗
  • ·The Snort rule uses a URI bsize match of exactly 20 bytes for /goform/PowerSaveSet — ensure your IDS/IPS does not normalize or truncate URIs before inspection, or the fast_pattern match may fail.
  • ·The PCRE in the Snort rule (/^[^&]{100,}(?:&|$)/R) is anchored relative to the 'time=' value position; confirm your IDS engine supports the /R (relative) PCRE flag to avoid missed detections.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.