CVE-2025-13446 is a high severity buffer overflow in the Tenda AC21 router, firmware 16.03.08.16, scored 8.8 by CVSS 3.1. The flaw is in the web management handler /goform/SetSysTimeCfg and is reached through the timeZone and time argument. The record lists no fixed firmware, so reduce exposure and watch the vendor.
What's affected
The record names Tenda AC21 router, firmware 16.03.08.16. The vulnerable code is the handler at /goform/SetSysTimeCfg, and the argument that triggers it is timeZone and time. The attack is remote and low complexity, but the vector requires a low privilege account, which for these devices usually means a login to the web interface.
The record says an exploit has been made public. It does not claim exploitation in the wild, and the CVE is not on the CISA Known Exploited Vulnerabilities list. No fixed firmware version is given in the record or its references.
How to check if you're exposed
Log in to the device and read the firmware version on the status or system page. Compare it to the version above. If it matches, assume you are affected. Then check whether the management interface is reachable from outside your network. From a machine on the internet side, a port scan of your public address for the web admin ports will show it.
On your own network, list routers and gateways in your asset inventory and note model and firmware for each. A firmware or SBOM scan is the cleanest way to find embedded components across many devices. The Gold directory shows how this entry is tracked.
What to do now
- Identify every device of this model and note its firmware version.
- Turn off remote administration from the internet side. Management pages should only answer on the internal network.
- Change the administrator password to a long unique one, since exploitation needs a logged in session.
- Put the device on a segment where a compromise cannot reach servers and workstations.
- Check the vendor support page for a firmware update and read its release notes before installing.
- If the model is end of life with no update, plan to replace it.
- Watch the device for unexpected reboots, changed settings or new outbound connections.
Why it matters
The cause is a memory handling error, listed as CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-121 (stack-based buffer overflow). The handler copies a value from the web request into a fixed size buffer without checking its length. Data written past the end of the buffer can corrupt memory next to it, which at best crashes the service and at worst lets an attacker run their own code.
The CVSS vector rates confidentiality, integrity and availability impact as high, and that is typical of memory corruption on a router: the device sits between your network and the internet, so control of it exposes everything behind it. The need for a login limits who can try, but weak or default passwords on home and small office gear are common.
Embedded firmware is hard to patch, which is why the first steps above are about exposure rather than updates.
Quick check
Does CVE-2025-13446 need a login?
The CVSS vector lists low privileges required, so a login to the device is expected, although weak or default passwords make that a thin barrier.
Is there a fixed firmware?
None is named in the record. Check the vendor's support page and the advisory before relying on any claim of a fix.
Sources
Last reviewed: 19 October 2026.
