cbcvebase.
CVE-2025-7544
published 2025-07-13

CVE-2025-7544: A vulnerability was found in Tenda AC1206 15.03.06.23. It has been rated as critical. This issue affects the function formSetMacFilterCfg of the file…

PriorityP185high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
1.58%
72.9th percentile
A vulnerability was found in Tenda AC1206 15.03.06.23. It has been rated as critical. This issue affects the function formSetMacFilterCfg of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected

2 ranges
VendorProductVersion rangeFixed in
tendaac1206——
tendaac1206_firmware——

Detection & IOCsextracted from sources · hover to see the quote

url/goform/setMacFilterCfg↗
  • →Monitor for POST/GET requests targeting the /goform/setMacFilterCfg endpoint on Tenda AC1206 devices, particularly with oversized or malformed 'deviceList' argument values indicative of stack-based buffer overflow attempts. ↗
  • →Tenda AC1206 firmware version 15.03.06.23 is the confirmed vulnerable version; flag or block exploitation attempts against devices running this firmware. ↗
  • →Detect Tenda AC1206 devices being enrolled into the Zerobot Mirai-based botnet following exploitation of CVE-2025-7544; look for anomalous outbound C2 traffic from router devices post-exploitation. ↗
  • ·The exploit has been publicly disclosed and is actively being used in the wild as part of botnet campaigns; patch or isolate affected devices immediately. ↗
  • ·CVE-2025-7544 is being chained with other CVEs (e.g., CVE-2025-68613) in the same Zerobot botnet campaign, suggesting coordinated multi-vector exploitation. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vulncheck7.4HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.