CVE-2025-14656: Tenda AC20 Firmware

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

A weakness has been identified in Tenda AC20 16.03.08.12. This affects the function httpd of the file /goform/openSchedWifi. Executing a manipulation of the argument schedStartTime/schedEndTime can lead to buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

Affected products

• Tenda AC20 Firmware: version 16.03.08.12 only

Published 2025-12-14. Last modified 2026-10-07.