CVE-2025-5850: A vulnerability was found in Tenda AC15 15.03.05.19_multi. It has been declared as critical. This vulnerability affects the function formsetschedled of the…

PriorityP268high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

4.08%

89.5th percentile

A vulnerability was found in Tenda AC15 15.03.05.19_multi. It has been declared as critical. This vulnerability affects the function formsetschedled of the file /goform/SetLEDCf of the component HTTP POST Request Handler. The manipulation of the argument Time leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
tenda	ac15	—	—
tenda	ac15_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

url/goform/SetLEDCfg↗

urlhttps://candle-throne-f75.notion.site/Tenda-AC15-formsetschedled-20adf0aa118580d984d8fcdb98d9959c

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Tenda SetLEDCfg time Parameter Buffer Overflow Attempt (CVE-2025-5850)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:17; content:"/goform/SetLEDCfg"; fast_pattern; http.request_body; content:"time"; pcre:"/^[^\x2c\x7d$]{100,}(?:\x2c|\x7d|$)/R"; reference:url,candle-throne-f75.notion.site/Tenda-AC15-formsetschedled-20adf0aa118580d984d8fcdb98d9959c; reference:cve,2025-5850; classtype:web-application-attack; sid:2062820; rev:1; metadata:affected_product Tenda, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_06_09, cve CVE_2025_5850, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_06_09, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

→Match HTTP POST requests to URI /goform/SetLEDCfg with a body containing a 'time' parameter value of 100 or more characters not containing commas or closing braces — indicative of buffer overflow exploitation.
→The vulnerable endpoint is /goform/SetLEDCfg (mapped to function formsetschedled), triggered via HTTP POST. The overflow occurs in the 'Time' argument. ↗
→Detection should be scoped to plaintext (non-TLS) traffic at the network perimeter and internally, targeting destination IPs running Tenda AC15 firmware.

·The exploit has been publicly disclosed; affected firmware version is Tenda AC15 15.03.05.19_multi. No patch information is provided in the sources. ↗
·The Snort/Suricata rule (sid:2062820) uses a URI bsize match of exactly 17 bytes for /goform/SetLEDCfg — ensure your IDS/IPS does not normalize or truncate URIs before matching.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.