CVE-2025-13258: Tenda AC20 Firmware

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

A vulnerability was detected in Tenda AC20 up to 16.03.08.12. The impacted element is an unknown function of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto results in buffer overflow. The attack can be launched remotely. The exploit is now public and may be used.

Affected products

• Tenda AC20 Firmware: version 16.03.08.12 only

Published 2025-11-17. Last modified 2026-06-17.