{"id":"CVE-2025-9090","published":"2025-08-17T02:02:07Z","modified":"2025-08-18T17:46:22Z","title":"Tenda AC20 Telnet Service telnet websFormDefine command injection","vendor":"Tenda","product":"AC20","tier":"core","eol":null,"affectedVersions":[{"vendor":"Tenda","product":"AC20","versions":["16.03.08.12"]}],"description":{"text":"A vulnerability was identified in Tenda AC20 16.03.08.12. Affected is the function websFormDefine of the file /goform/telnet of the component Telnet Service. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","provenance":"source","from":"CVE.org"},"summary":{"text":"A command injection flaw in the Telnet Service component of the Tenda AC20 router firmware (version 16.03.08.12), specifically in the websFormDefine function handling the /goform/telnet endpoint, lets an attacker inject operating system commands through crafted input. An attacker can exploit this remotely over the network with low-privilege authenticated access and requires no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:40Z"},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.16651,"percentile":0.97014,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-09-27","exploitedFirstSeen":"2026-09-28","ransomware":false,"evidence":[{"url":"https://www.linkedin.com/posts/ccondon_vulncheck-canary-intelligence-picked-up-share-7510150669430013952-vgS4/","date":"2026-09-28"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"},{"id":"CWE-74","name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component"}],"references":[{"url":"https://vuldb.com/?id.320358","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.320358","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.632232","tags":["third-party-advisory"]},{"url":"https://github.com/ZZ2266/.github.io/blob/main/AC20/telnet/readme.md","tags":["related"]},{"url":"https://github.com/ZZ2266/.github.io/blob/main/AC20/telnet/readme.md#poc-exploit-steps","tags":["exploit"]},{"url":"https://www.tenda.com.cn/","tags":["product"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-25139","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-25139","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":52418,"url":"https://www.exploit-db.com/exploits/52418","title":"Tenda AC20 16.03.08.12 - Command Injection","type":"remote","platform":"multiple","date":"2025-08-18","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-08-18"},"pocGithub":{"count":1,"skipped":0,"earliest":"2025-08-17","earliestUrl":"https://github.com/byteReaper77/CVE-2025-9090","repos":[{"name":"byteReaper77/CVE-2025-9090","url":"https://github.com/byteReaper77/CVE-2025-9090","stars":1,"created":"2025-08-17"}]},"first":{"date":"2025-08-17","source":"PoC-in-GitHub","url":"https://github.com/byteReaper77/CVE-2025-9090"},"provenance":"source"},"exploitRefs":["https://github.com/ZZ2266/.github.io/blob/main/AC20/telnet/readme.md#poc-exploit-steps"],"flow":[],"timeline":[{"date":"2025-08-17","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-9090","provenance":"source"},{"date":"2025-08-17","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2025-08-18","url":"https://github.com/byteReaper77/CVE-2025-9090","provenance":"source"},{"date":"2026-09-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.linkedin.com/posts/ccondon_vulncheck-canary-intelligence-picked-up-share-7510150669430013952-vgS4/","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":73.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 33 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.4,"detail":"percentile 0.9701"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":4.41,"detail":"base score 6.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}