CVE-2025-31355 Other in AC6 V5.0
Attackers can execute arbitrary code on Tenda AC6 routers by providing a malicious firmware update file due to improper signature validation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-31355?
CVE-2025-31355 is a high-severity vulnerability in Tenda Ac6 Firmware, published on 20 Aug 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A firmware update vulnerability exists in the Firmware Signature Validation functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted malicious file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Weakness: CWE-494
Which versions are affected by CVE-2025-31355?
It affects 1 product.
Products include Tenda Ac6 Firmware.
How do I fix CVE-2025-31355?
No fix has been published for CVE-2025-31355 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-31355 being exploited?
There is no known exploitation of CVE-2025-31355 in the wild and no public exploit code.
Other vulnerabilities in Tenda Ac6 Firmware
Sources
Also known as GHSA-w2vw-xc39-vh5c.