CVE-2025-63666

The device generates a session cookie that contains a hash of the user's password — sensitive information that should not be transmitted to the client. Additionally, the session identifier is short and based on entropy of low value, making it susceptible to brute-force guessing or analysis attacks. An attacker with access to the network or the ability to execute JavaScript code in the victim's browser (e.g., through XSS) can intercept such a cookie. After obtaining the cookie, the attacker can reuse it (replay attack), gaining access to the router's administrative panel without knowing the actual password.

An attacker can take full control of the Tenda AC15 router, gaining access to protected administrative resources — including the ability to modify network configuration, intercept network traffic, and potentially use the device as an entry point to the local network.

Apply patches available from the manufacturer according to references. Until an update is released, it is recommended to restrict access to the router's administrative panel only to trusted hosts on the local network and avoid managing the device through untrusted networks.

Tenda AC15 firmware version v15.03.05.18_multi