CVE-2025-9088

A vulnerability was found in Tenda AC20 16.03.08.12. This vulnerability affects the function save_virtualser_data of the file /goform/formSetVirtualSer. The manipulation of the argument list leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

• CWE-119
• CWE-121
• CWE-787

• https://github.com/ZZ2266/.github.io/tree/main/AC20/formSetVirtualSerExploit, Third Party Advisory
• https://github.com/ZZ2266/.github.io/tree/main/AC20/formSetVirtualSer#poc-python-exploit-scriptExploit, Third Party Advisory
• https://vuldb.com/?ctiid.320356Permissions Required, VDB Entry
• https://vuldb.com/?id.320356Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.632038Exploit, Third Party Advisory, VDB Entry
• https://www.tenda.com.cn/Product

Published

Aug 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9082The WPBITS Addons For Elementor plugin for WordPress is vuln…6.4
• CVE-2025-9083The Ninja Forms WordPress plugin before 3.11.1 unserializes…9.8
• CVE-2025-9084Mattermost versions 10.5.x <= 10.5.9 fail to properly valida…6.1
• CVE-2025-9085The User Registration & Membership plugin for WordPress is v…4.9
• CVE-2025-90861. A cookie is set using the `secure` keyword for `https://t…7.5
• CVE-2025-9087A vulnerability has been found in Tenda AC20 16.03.08.12. Th…9.8
• CVE-2025-9089A vulnerability was determined in Tenda AC20 16.03.08.12. Th…9.8
• CVE-2025-9090A vulnerability was identified in Tenda AC20 16.03.08.12. Af…9.8
• CVE-2025-9091A security flaw has been discovered in Tenda AC20 16.03.08.1…7.8
• CVE-2025-9092Uncontrolled Resource Consumption vulnerability in Legion of…1
• CVE-2025-9093A security vulnerability has been detected in BuzzFeed App 2…5.5
• CVE-2025-9094A vulnerability was detected in ThingsBoard 4.1. This vulner…4.3