---
id: CVE-2025-15215
title: A vulnerability was determined in Tenda AC10U 15.03.06.48/15.03.06.49
summary: >-
  A vulnerability was determined in Tenda AC10U 15.03.06.48/15.03.06.49. This
  affects the function formSetPPTPUserList of the file /goform/setPptpUserList
  of the component HTTP POST Request Handler. This manipulation of the argument
  list c…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-119
  - CWE-120
vendor: tenda
product: ac10u_firmware
affected:
  - ac10u_firmware = 15.03.06.48
  - ac10u_firmware = 15.03.06.49
published: '2025-12-30'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T12:10:00.170'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-15215'
references:
  - url: 'https://vuldb.com/?ctiid.338600'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?id.338600'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?submit.725365'
    label: cna@vuldb.com
  - url: >-
      https://www.notion.so/Tenda-AC10U-setPptpUserList-2d753a41781f80e8ba6bc37ba6100343?pvs=73
    label: cna@vuldb.com
  - url: 'https://www.tenda.com.cn/'
    label: cna@vuldb.com
tags:
  - nvd
epss: 0.00702
epssPercentile: 0.53041
ingestedAt: '2026-10-01T18:55:42.316Z'
---

## Overview

A vulnerability was determined in Tenda AC10U 15.03.06.48/15.03.06.49. This affects the function formSetPPTPUserList of the file /goform/setPptpUserList of the component HTTP POST Request Handler. This manipulation of the argument list causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

## Affected

- `ac10u_firmware = 15.03.06.48`
- `ac10u_firmware = 15.03.06.49`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.