CVE-2025-63666: Tenda AC15 Firmware

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to access protected resources.

Affected products

• Tenda AC15 Firmware: version 15.03.05.18 only

Published 2025-11-12. Last modified 2026-06-17.