CVE-2025-63834

A stored cross-site scripting (XSS) vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. The vulnerability exists in the ssid parameter of the wireless settings. Remote attackers can inject malicious payloads that execute when any user visits the router's homepage.

Score

CVSS 3.1 5.4 Medium

Status

Modified - cve@mitre.org

Published

2025-11-10

Last modified

2025-12-01

Weaknesses

CWE-79

Affected products

• Ac18 Firmware (Tenda)

References

• https://github.com/babraink/cve_report/blob/main/cve_report/tenda/tendaAC18/wifiset_ssid_xss/README.md