Tenda W12 CVE-2025-11550

The attacker must have network connectivity to the router's management web interface (usually on the LAN side unless remote access is enabled) and possess low-privileged credentials (e.g., a user account with access to the WiFi schedule settings). The wifiScheduledSet function is part of the default firmware; no special configuration is required beyond having the management service running. Remote exploitation from the Internet is possible only if the admin interface is exposed, a practice that is strongly discouraged.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) indicates a remotely exploitable denial-of-service with low attack complexity and low privileges required, leading to high availability impact. The EPSS score of 0.09% places it in the 25th percentile, indicating a very low likelihood of exploitation in the wild. The absence from CISA's Known Exploited Vulnerabilities (KEV) catalog further supports that no active exploitation campaigns have been observed. While a public proof-of-concept exists, the requirement for low-privileged credentials and the targeted nature of consumer-grade routers reduce the urgency. The risk is primarily a local network disruption rather than a widespread internet threat.

An attacker who has obtained low-privilege credentials to the router's web interface (for example, through default passwords or credential sniffing) sends a specially crafted HTTP request to the /goform/modules endpoint, with a malicious wifiScheduledSet argument. The request triggers a null pointer dereference in the handler, causing the management service to crash and rendering the router unresponsive until rebooted. The publicly available PoC demonstrates this step-by-step.