CVE-2025-65222: Tenda AC21 router firmware · CVE-2025-65222 is a medium-severity buffer overflow
Source CVE Database V5
Not known to be exploited · CVSS 4.3 Medium.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 2.5% chance of exploitation in 30 days – higher than 84% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 20 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
- Immediately restrict access to the router’s management interface by limiting it to trusted internal networks and disabling remote management if not required.
- Implement network segmentation to isolate critical systems from devices running vulnerable firmware.
- Monitor network traffic for unusual or malformed requests targeting /goform/SetSysAutoRebbotCfg or the rebootTime parameter.
- Regularly check for firmware updates from Tenda and apply patches promptly once available.
- Consider replacing vulnerable Tenda AC21 routers with models from vendors with stronger security track records if patching is delayed.
- Employ intrusion detection/prevention systems (IDS/IPS) capable of detecting buffer overflow attempts or anomalous HTTP requests.
- Educate IT staff about this specific vulnerability to ensure rapid response to any signs of exploitation attempts.
- Maintain backups and redundancy for critical network infrastructure to minimize downtime impact.
Description
CVE-2025-65222 is a medium-severity buffer overflow vulnerability in the Tenda AC21 router firmware version V16.03.08.16, exploitable via the rebootTime parameter in the /goform/SetSysAutoRebbotCfg endpoint. The flaw allows an attacker with network access to cause a denial of service by crashing the device, as it impacts availability without requiring authentication or user interaction. No known exploits are currently in the wild, and no patches have been published yet. The vulnerability affects the router’s firmware and could disrupt network connectivity if exploited. European organizations using Tenda AC21 routers, especially in small office or home office environments, may face service interruptions. Mitigation involves network segmentation, restricting access to router management interfaces, and monitoring for anomalous requests. Countries with higher Tenda market penetration and critical infrastructure relying on such devices are more likely to be impacted.