# CVEs published 2025-06-08 33 CVEs were published on June 8, 2025: 1 critical, 21 high. Days are UTC. - [CVE-2025-5851](https://cve.now/CVE-2025-5851.md): Tenda AC15 HTTP POST Request AdvSetLanip fromadvsetlanip buffer overflow (CVSS 8.7, Tenda AC15) - [CVE-2025-5850](https://cve.now/CVE-2025-5850.md): Tenda AC15 HTTP POST Request SetLEDCf formsetschedled buffer overflow (CVSS 8.7, Tenda AC15) - [CVE-2025-5849](https://cve.now/CVE-2025-5849.md): Tenda AC15 HTTP POST Request SetRemoteWebCfg formSetSafeWanWebMan stack-based overflow (CVSS 8.7, Tenda AC15) - [CVE-2025-5848](https://cve.now/CVE-2025-5848.md): Tenda AC15 HTTP POST Request setPptpUserList formSetPPTPUserList buffer overflow (CVSS 8.7, Tenda AC15) - [CVE-2025-35010](https://cve.now/CVE-2025-35010.md): Microhard Bullet-LTE and IPn4Gii AT+MNPINGTM Argument Injection (CVSS 7.1, Microhard IPn4Gii / Bullet-LTE Firmware) - [CVE-2025-35009](https://cve.now/CVE-2025-35009.md): Microhard Bullet-LTE and IPn4Gii AT+MNNETSP Argument Injection (CVSS 7.1, Microhard IPn4Gii / Bullet-LTE Firmware) - [CVE-2025-35008](https://cve.now/CVE-2025-35008.md): Microhard Bullet-LTE and IPn4Gii AT+MMNAME Argument Injection (CVSS 7.1, Microhard IPn4Gii / Bullet-LTE Firmware) - [CVE-2025-35007](https://cve.now/CVE-2025-35007.md): Microhard Bullet-LTE and IPn4Gii AT+MFRULE Argument Injection (CVSS 7.1, Microhard IPn4Gii / Bullet-LTE Firmware) - [CVE-2025-35006](https://cve.now/CVE-2025-35006.md): Microhard Bullet-LTE and IPn4Gii AT+MFPORTFWD Argument Injection (CVSS 7.1, Microhard IPn4Gii / Bullet-LTE Firmware) - [CVE-2025-35005](https://cve.now/CVE-2025-35005.md): Microhard Bullet-LTE and IPn4Gii AT+MFMAC Argument Injection (CVSS 7.1, Microhard IPn4Gii / Bullet-LTE Firmware) - [CVE-2025-35004](https://cve.now/CVE-2025-35004.md): Microhard Bullet-LTE and IPn4Gii AT+MFIP Argument Injection (CVSS 7.1, Microhard IPn4Gii / Bullet-LTE Firmware) - [CVE-2025-32459](https://cve.now/CVE-2025-32459.md): ON Semiconductor Quantenna router\_command.sh (in the sync\_time argument) Argument Injection (CVSS 7.7, ON Semiconductor Quantenna Wi-Fi chipset) - [CVE-2025-32458](https://cve.now/CVE-2025-32458.md): ON Semiconductor Quantenna router\_command.sh (in the get\_syslog\_from\_qtn argument) Argument Injection (CVSS 7.7, ON Semiconductor Quantenna Wi-Fi chipset) - [CVE-2025-32457](https://cve.now/CVE-2025-32457.md): ON Semiconductor Quantenna router\_command.sh (in the get\_file\_from\_qtn argument) Argument Injection (CVSS 7.7, ON Semiconductor Quantenna Wi-Fi chipset) - [CVE-2025-32456](https://cve.now/CVE-2025-32456.md): ON Semiconductor Quantenna router\_command.sh (in the put\_file\_to\_qtn argument) Argument Injection (CVSS 7.7, ON Semiconductor Quantenna Wi-Fi chipset) - [CVE-2025-32455](https://cve.now/CVE-2025-32455.md): ON Semiconductor Quantenna router\_command.sh (in the run\_cmd argument) Argument Injection (CVSS 7.7, ON Semiconductor Quantenna Wi-Fi chipset) - [CVE-2025-3461](https://cve.now/CVE-2025-3461.md): ON Semiconductor Quantenna Telnet Missing Authentication (CVSS 9.1, ON Semiconductor Quantenna Wi-Fi chipset) - [CVE-2025-3460](https://cve.now/CVE-2025-3460.md): ON Semiconductor Quantenna set\_tx\_pow Argument Injection (CVSS 7.7, ON Semiconductor Quantenna Wi-Fi chipset) - [CVE-2025-3459](https://cve.now/CVE-2025-3459.md): ON Semiconductor Quantenna transmit\_file Argument Injection (CVSS 7.7, ON Semiconductor Quantenna Wi-Fi chipset) - [CVE-2025-5847](https://cve.now/CVE-2025-5847.md): Tenda AC9 HTTP POST Request SetRemoteWebCfg formSetSafeWanWebMan stack-based overflow (CVSS 8.7, Tenda AC9) - [CVE-2025-27247](https://cve.now/CVE-2025-27247.md): Pasteboard has an improper preservation of permissions vulnerability (CVSS 5.5, OpenHarmony) - [CVE-2025-27242](https://cve.now/CVE-2025-27242.md): Ssecurity\_component\_manager has an improper input vulnerability (CVSS 3.3, OpenHarmony) - [CVE-2025-27563](https://cve.now/CVE-2025-27563.md): security\_access\_token has an improper preservation of permissions vulnerability (CVSS 3.3, OpenHarmony) - [CVE-2025-26693](https://cve.now/CVE-2025-26693.md): security\_access\_token has an improper preservation of permissions vulnerability (CVSS 3.3, OpenHarmony) - [CVE-2025-26691](https://cve.now/CVE-2025-26691.md): telephony\_call\_manager has an improper preservation of permissions vulnerability (CVSS 5.5, OpenHarmony) - [CVE-2025-27131](https://cve.now/CVE-2025-27131.md): kernel\_liteos\_m has an improper input vulnerability (CVSS 6.1, OpenHarmony) - [CVE-2025-24493](https://cve.now/CVE-2025-24493.md): kernel\_liteos\_a has a race condition vulnerability (CVSS 5.5, OpenHarmony) - [CVE-2025-25217](https://cve.now/CVE-2025-25217.md): arkui\_ace\_enginehas a NULL pointer dereference vulnerability (CVSS 3.3, OpenHarmony) - [CVE-2025-23235](https://cve.now/CVE-2025-23235.md): arkcompiler\_ets\_runtime has an out-of-bounds write vulnerability (CVSS 3.3, OpenHarmony) - [CVE-2025-21082](https://cve.now/CVE-2025-21082.md): arkui\_ace\_engine has a type confusion vulnerability (CVSS 3.3, OpenHarmony) - [CVE-2025-20063](https://cve.now/CVE-2025-20063.md): arkui\_ace\_engine has a type confusion vulnerability (CVSS 3.3, OpenHarmony) - [CVE-2025-38004](https://cve.now/CVE-2025-38004.md): can: bcm: add locking for bcm\_op runtime updates (CVSS 7.3, Linux) - [CVE-2025-38003](https://cve.now/CVE-2025-38003.md): can: bcm: add missing rcu read protection for procfs content (CVSS 7.8, Linux) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-06-08 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.