Tenda W12
CVE-2025-11549
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device web interface over network
-
DeliveryAuthenticate with low-privilege credentials
-
ExploitSend crafted /goform/modules request with oversized mac
-
ExecutionOverflow stack buffer in wifiMacFilterSet
-
ImpactExecute arbitrary code on router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access (CVSS PR:L) to the HTTP management interface and the ability to invoke the wifiMacFilterSet function via the /goform/modules endpoint with an attacker-controlled, overlong 'mac' argument. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once authenticated the overflow triggers against the default firmware. Limiting factors: the attacker must first reach the router's web interface - typically LAN-side unless remote management is exposed - and must hold valid low-privilege credentials or a session; exploitation is confined to the single affected build, Tenda W12 firmware 3.0.0.6(3948). |
| Impact | Signals are moderately concerning but not top-tier. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-privileged authentication, with high confidentiality, integrity and availability impact to the device (VC:H/VI:H/VA:H) and no scope change. A publicly available exploit exists (github-poc), and the SSVC-relevant signal E:P ('Proof-of-Concept') in the 4.0 vector is consistent with that. EPSS is elevated at 8.48% (95th percentile), which is high for a device-specific bug and reflects the published PoC and the well-known pattern of Tenda /goform buffer overflows being trivially reproducible. However, this is NOT confirmed actively exploited - it is absent from CISA KEV - so the high EPSS indicates likelihood/ease of exploitation rather than observed in-the-wild campaigns. The PR:L requirement is the main limiter: exploitation is not fully unauthenticated, so the realistic attacker must first reach and authenticate to the device web interface (typically LAN-side or an exposed management port). Net assessment: a credible medium-to-high priority for anyone actually running the specific Tenda W12 3.0.0.6(3948) firmware, driven by PoC availability and high EPSS, but tempered by the authentication prerequisite and the narrow affected-product footprint. |
| Exploit ScenarioDerived | An attacker with network access to the Tenda W12 management interface and low-privilege credentials sends a crafted HTTP POST to /goform/modules invoking the wifiMacFilterSet handler with an overlong 'mac' argument. This overflows a stack buffer, corrupting the return address and enabling arbitrary code execution on the router. A public proof-of-concept for exactly this handler is available on GitHub, making reproduction straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Stack-based buffer overflow in Tenda W12 firmware version 3.0.0.6(3948) allows an authenticated remote attacker to crash or potentially execute code on the device by sending an overlong 'mac' argument to the wifiMacFilterSet function exposed through the /goform/modules HTTP endpoint. Exploitation requires valid low-privilege credentials or a session on the router's web management interface (CVSS PR:L), which in practice means LAN-side access unless remote management is exposed to the WAN; no user interaction is needed and attack complexity is low. Publicly available exploit code exists (a GitHub PoC with a binary-audit write-up), EPSS is 8.48% (95th percentile) indicating elevated real-world attention, but there is no KEV entry confirming active exploitation, and the flaw is confined to this single firmware build.
RemediationAI
No vendor-released patch is identified in the available data: the references point to VULDB entries, a public GitHub PoC, and the Tenda website, but no fixed firmware version or dedicated advisory is provided, so administrators should check https://www.tenda.com.cn/ and their regional Tenda support channel for an updated W12 firmware and apply it as soon as one is published. Until then, apply targeted compensating controls that reduce reachability of the vulnerable handler: disable WAN/remote management so the web interface is only accessible from the trusted LAN (side effect: loses remote administration, requires on-site or VPN access), restrict management access with firewall rules or VLAN segmentation so only administrative hosts can reach TCP/HTTP management ports (side effect: adds configuration overhead and can break management tooling), and replace default or weak administrative credentials with strong unique ones to satisfy the PR:L authentication prerequisite (side effect: credential rotation effort, no protection if an attacker already holds a session). Since the trigger is a malformed 'mac' value sent to /goform/modules, detecting and alerting on abnormal or oversized parameters to that endpoint via IDS/IPS or egress monitoring is a useful detective layer, and rebooting or failing over the device should be planned for in case of a crash-induced denial of service.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic stack-based buffer overflow (CWE-119, improper restriction of operations within the bounds of a memory buffer) in the HTTP request handler component of the Tenda W12 router firmware. Specifically, the wifiMacFilterSet function in /goform/modules copies the attacker-supplied 'mac' parameter into a fixed-size stack buffer without adequate length validation, so an oversized value overwrites adjacent stack memory. The crafted request reaches the CGI handler (referenced in the PoC as cgiWifiMacFilterSet) over the device's embedded web management interface, meaning the vulnerable surface is the router's HTTP administrative service rather than any wireless protocol. The provided CPE (cpe:2.3:o:tenda:w12_firmware:3.0.0.6\(3948\)) confirms the affected target is the firmware image only, not a separate software package, and the root cause class is a memory-safety error that can lead to a crash (denial of service) and, depending on stack layout and mitigations, to control-flow hijack.
Know when W12 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web handler, low complexity, but requires low-privilege authentication (PR:L) per the vendor 4.0 vector; code execution yields full C/I/A impact with no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability has been found in Tenda W12 3.0.0.6(3948). The affected element is the function wifiMacFilterSet of the file /goform/modules of the component HTTP Request Handler. The manipulation of the argument mac leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Tenda W12 routers running firmware 3.0.0.6(3948) carry a high-severity memory-corruption flaw in their web management interface that lets anyone holding valid low-privilege credentials crash the device or potentially run their own code on it, and no vendor fix exists today. Publicly available exploit code lowers the skill barrier for attackers, meaning any of these routers left reachable on a LAN segment - branch offices, retail sites, or home-worker setups - is a live liability. Leadership should treat this as an availability and perimeter-integrity risk for any location relying on this hardware, since a single compromised or weak credential could take a network segment offline or serve as a staging point for deeper access.
No vendor-released patch identified at time of analysis. Interim mitigations: disable WAN/remote management and block external access to the HTTP management interface; restrict /goform/modules to trusted administrative hosts via VLAN segmentation or firewall ACLs; enforce unique strong admin credentials and least-privilege access; enable guest/client network isolation; disable unnecessary services such as UPnP and WPS; monitor for device reboots, crashes, or anomalous management traffic as exploitation indicators; plan device replacement if the vendor does not ship a fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in W12 Firmware
View allA vulnerability was found in Tenda W12 3.0.0.5. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitab
A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644) and classified as critical. Rated high severi
A vulnerability classified as critical was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644). Rated high severity (
A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644). Rated high severity (CVSS 8.7), this vulnera
A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644). Rated high severity (CVSS 8.7), this vulnera
Denial-of-service in Tenda W12 router firmware 3.0.0.6(3948) via a null pointer dereference in the `wifiScheduledSet` HT
Exploit-DB