TI-2025-13053 Aliases CVE-2025-14286 GHSA-mm27-h58x-qxc3

Tenda AC9 Configuration File DownloadCfg.jpg information disclosure

HIGH 70CWE-200Published 2025-12-09 · Updated 2026-02-24

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure, Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-284.

Summary

A vulnerability was determined in Tenda AC9 15.03.05.14_multi. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/DownloadCfg.jpg of the component Configuration File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00675 52nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Tenda	AC9	15.03.05.14_multi	—	No fix listed	CNA

AC9 VendorTenda Affected 15.03.05.14_multi Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:tenda:ac9_firmware:15.03.05.14_multi:::::::*	15.03.05.14_multi	Vulnerable	Tenda
cpe:2.3:o:tenda:ac9_firmware:1.0:::::::*	1.0	Running on	Tenda

cpe:2.3:o:tenda:ac9_firmware:15.03.05.14_multi:*:*:*:*:*:*:* Versions 15.03.05.14_multi Vulnerable ·Tenda
cpe:2.3:o:tenda:ac9_firmware:1.0:*:*:*:*:*:*:* Versions 1.0 Running on ·Tenda

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-14286
2026-10-03 Alias added: GHSA-mm27-h58x-qxc3

References

Exploit 1

https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN11.md

Other 1

https://www.tenda.com.cn/

TI-2018-10434 An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7)… KEVCVSS 3.1CRITICAL 9.8
TI-2025-28777 In the Tenda ac9 v1.0 router with firmware V15.03.05.14_multi, there is a stack overflow… CVSS 3.1CRITICAL 9.8
TI-2025-28776 In Tenda ac9 v1.0 with firmware V15.03.05.14_multi, the rebootTime parameter of… CVSS 3.1CRITICAL 9.8
TI-2025-28775 In Tenda AC9 v1.0 with firmware V15.03.05.14_multi, the security parameter of… CVSS 3.1CRITICAL 9.8
TI-2025-28726 Tenda AC9 v15.03.05.14 was discovered to contain a command injection vulnerability via the Telnet function. CVSS 3.1CRITICAL 9.8
TI-2025-28675 Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in… CVSS 3.1CRITICAL 9.8

See all 91 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences