CVE-2025-0848 is a medium severity stack based buffer overflow (CVSS 6.5) in Tenda A18 firmware up to 15.13.07.09. The record lists no fixed version. Limit access to the router admin interface and check Tenda's site for firmware updates.
What's affected
- Product: Tenda A18 router and its firmware.
- Affected versions in the record: up to and including 15.13.07.09.
- Location: the
SetCmdlineRunfunction behind/goform/SetCmdlineRun, in the HTTP POST request handler, through thewpapsk_crypto5gargument. - Weaknesses: CWE-119, CWE-121 and CWE-787.
- Fixed version: none is listed in the record. The record references the Tenda website, so check the support page for your model.
- CISA KEV: not listed. The record says the exploit has been disclosed to the public.
The CVSS vector is network, low complexity, low privileges required, no user interaction, with a high impact on availability only. In plain terms, the described result is a crash or denial of service on the device, and someone with a login to the admin interface. The record does not claim code execution.
How to check if you're exposed
- Log in to the router's admin page and find the firmware version on the status or system page.
- Compare it with 15.13.07.09. Anything at or below that is in the affected range.
- Check whether the admin interface is reachable from the internet. Look for remote management or port forwarding rules that expose the web interface.
- Look at your router's list of admin accounts and connected devices for anything you do not recognize.
What to do now
- Turn off remote administration on the WAN side. The admin page should be reachable only from your local network.
- Change the admin password to a long, unique one, since the attack needs a login.
- Check the Tenda support site for a firmware newer than 15.13.07.09 and apply it if one exists. Back up your settings first.
- Keep guests and untrusted devices on a separate network that cannot reach the admin page.
- If the model is out of support and no fix appears, plan to replace it.
Why it matters
A stack based overflow happens when input is copied into a fixed size buffer on the stack without checking its length. The extra data overwrites neighboring memory. On a router, the usual outcome is a crash and reboot, and sometimes worse depending on the build and the protections in the firmware.
Home and small office routers are a good example of software nobody inventories. They run for years, take updates rarely and sit on the network edge. A medium score is not a reason to ignore one. It is a reason to keep it off the internet and to patch when a fix appears.
The weaknesses here are memory safety classes. They have simple fixes in code, such as checking lengths before copying, but only the vendor can ship that fix in firmware. The record does not state that the vendor has done so.
Quick check
Is there a firmware fix for CVE-2025-0848?
The record lists none. Check Tenda's support page for your model and apply any firmware newer than 15.13.07.09.
Can someone exploit this without logging in?
The CVSS vector requires low privileges, so the described attack needs an authenticated session. Weak or default passwords make that easier, so change them.
Sources
- Public report referenced in the record
- VulDB entry 294011
- Tenda website
- NVD record for CVE-2025-0848
Last reviewed: 19 October 2026.
