CVE-2025-5836 | Tenda AC9 15.03.02.13 POST Request /goform/SetIPTVCfg formSetIptv list command injection

A vulnerability was found in Tenda AC9 15.03.02.13. It has been rated as critical. This issue affects the function formSetIptv of the file /goform/SetIPTVCfg of the component POST Request Handler. The manipulation of the argument list leads to command injection.

The identification of this vulnerability is CVE-2025-5836. The attack may be initiated remotely. Furthermore, there is an exploit available.