CVE-2025-9090

low · 2.1

A vulnerability was identified in Tenda AC20 16.03.08.12. Affected is the function websFormDefine of the file /goform/telnet of the component Telnet Service. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

2.1

CVSS

14.1%

EPSS (exploit prob.)

96th

EPSS percentile

2025-08-17

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-74CWE-77

Affected products

Vendor	Product	Affected versions
tenda	ac20_firmware	16.03.08.12
tenda	ac20	all versions

Check a specific version with /api/v1/cve/match.

References

https://github.com/ZZ2266/.github.io/blob/main/AC20/telnet/readme.md
https://github.com/ZZ2266/.github.io/blob/main/AC20/telnet/readme.md#poc-exploit-steps
https://vuldb.com/?ctiid.320358
https://vuldb.com/?id.320358
https://vuldb.com/?submit.632232
https://www.tenda.com.cn/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-9090