CVE-2025-65221: n/a
Source CVE Database V5
Not known to be exploited · CVSS 4.3 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 24% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 20 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
AI-suggested
1. Immediately restrict access to the router's management interface by limiting it to trusted internal networks and disabling remote management if not required. 2. Implement network segmentation to isolate router management traffic from general user traffic, reducing exposure to potential attackers. 3. Monitor router logs and network traffic for unusual requests targeting the /goform/setPptpUserList endpoint or signs of device instability. 4. Where possible, replace affected Tenda AC21 routers with models from vendors providing timely security updates and patches. 5. If replacement is not feasible, consider deploying firewall rules to block unauthorized access to the vulnerable endpoint. 6. Educate users and IT staff about the vulnerability and encourage vigilance for signs of network disruption. 7. Regularly check for firmware updates from Tenda and apply patches promptly once available. 8. Employ intrusion detection/prevention systems (IDS/IPS) to detect exploitation attempts targeting this vulnerability. 9. Review VPN configurations and consider alternative secure remote access solutions until the vulnerability is resolved.
Description
CVE-2025-65221 is a medium severity buffer overflow vulnerability in the Tenda AC21 router firmware version V16.03.08.16, exploitable via the 'list' parameter of the /goform/setPptpUserList endpoint. The flaw allows an attacker to cause a denial of service by crashing the device, as it impacts availability without requiring authentication or user interaction. There are no known exploits in the wild, and no patches have been released yet. The vulnerability does not affect confidentiality or integrity but can disrupt network availability. European organizations using Tenda AC21 routers, especially in small office or home office environments, should be aware of this risk. Mitigation involves restricting access to the router management interface, network segmentation, and monitoring for unusual device behavior. Countries with higher adoption of Tenda networking products and significant SME sectors are more likely to be impacted.