Tenda O3
CVE-2025-12209
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device web interface with low privileges
-
DeliverySend crafted /goform/setDhcpConfig request
-
ExploitOverflow stack via dhcpEn argument
-
ExecutionCorrupt return address / execute shellcode
-
ImpactGain control or crash router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires sending a request to the /goform/setDhcpConfig endpoint with a manipulated dhcpEn parameter, reaching the SetValue/GetValue DHCP configuration handler on the Tenda O3 device's HTTP management interface. The CVSS vector specifies PR:L, so the attacker needs low-level authenticated access to the web interface - this is the primary limiting factor, meaning the management interface must be reachable by the attacker (typically LAN or an exposed/remotely-accessible admin plane) and valid low-privilege credentials or an authenticated session are required. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Realistic risk is bounded by whether the router's management interface is exposed beyond the local network and whether default/weak credentials permit the required low-privilege access. |
| Impact | Signals are mixed and point to a real-but-not-urgent issue. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 7.4) indicates a network-reachable, low-complexity flaw requiring low-level privileges (PR:L = authenticated) with high confidentiality/integrity/availability impact and no scope change. A public exploit exists (POC=YES) but there is NO CISA KEV listing, so this is publicly available exploit code, not confirmed active exploitation. EPSS is only 1.03% (63rd percentile), consistent with proof-of-concept availability against a low-footprint product rather than mass exploitation. A notable data tension: the CVSS 4.0 vector shows E:P (Proof-of-Concept exploit maturity), which agrees with the POC signal and argues against treating this as actively weaponized. Another caveat - the CVE is filed against Tenda O3 1.0.0.10(2478) but the single exploit reference path is for 'O3v2.0', so the exact affected hardware/firmware revision should be verified with the vendor. The reporting CNA is cna@vuldb.com (VulDB), a source that auto-generates many low-interaction IoT entries, so independent confirmation of impact is advisable. Net: a genuine authenticated remote stack overflow worth patching, but low EPSS, no KEV, and a niche product make it a moderate priority rather than an emergency. |
| Exploit ScenarioDerived | An attacker with low-level access to the device's web management interface (PR:L) sends a crafted request to /goform/setDhcpConfig with a manipulated dhcpEn argument, triggering a stack-based buffer overflow in the SetValue/GetValue handler. Because a POC has been publicly disclosed, an attacker could adapt it to crash the device or potentially execute arbitrary code on the router. Exploitation is network-reachable and low-complexity, though it depends on reaching the management interface and having the required privilege level. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Stack-based buffer overflow in the HTTP management interface of Tenda O3 firmware 1.0.0.10(2478) lets a low-privileged, authenticated remote attacker corrupt memory via a crafted dhcpEn parameter sent to /goform/setDhcpConfig, with the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) indicating high confidentiality, integrity and availability impact. The critical limiting factor is the PR:L requirement: the attacker must first reach the device's web management plane and hold valid low-privilege credentials or a session, so real-world exposure depends on whether the admin interface is reachable beyond the LAN (for example via enabled remote management or WAN-side access) and whether default or weak credentials remain in place. Publicly available exploit code exists and the EPSS score of 1.03% (63rd percentile) places it in the moderate-priority band; there is no CISA KEV confirmation of active exploitation, and no vendor-released patch has been identified at time of analysis.
RemediationAI
No vendor-released patch has been identified at time of analysis, so the primary action is to monitor https://www.tenda.com.cn/ and the VulDB entry https://vuldb.com/?id.329879 for a fixed O3 firmware build and upgrade immediately once one is published; because the flaw lives in the fixed 1.0.0.10(2478) build, applying a later firmware revision is the only true fix and should be verified by re-testing /goform/setDhcpConfig. Until then, apply compensating controls and accept their trade-offs: disable remote/WAN-side web management so the admin plane is reachable only from the local network (this blocks the AV:N path that makes the bug remotely triggerable, at the cost of losing remote configuration), and if remote management is mandatory, front the device with a reverse proxy or firewall rule that permits only trusted source IPs and blocks POSTs to /goform/setDhcpConfig from untrusted networks (legitimate LAN administrators keep full access, but management becomes dependent on that gateway). Because the vector is PR:L, enforce a strong, unique administrator password and rotate any default Tenda credentials - this removes the low-privilege foothold the exploit requires, though it does not fix the underlying memory corruption. Additionally, isolate the O3 on a dedicated management VLAN or IoT segment so a successful overflow cannot pivot to other assets, and monitor the device's logs for anomalous or oversized dhcpEn requests to /goform/setDhcpConfig as a detection signal.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Tenda O3 is a wireless outdoor CPE/access-point device whose web management plane exposes several goform CGI endpoints over HTTP. In CVE-2025-12209, the SetValue/GetValue handlers behind /goform/setDhcpConfig process the dhcpEn argument without validating the length of attacker-supplied data before copying it into a fixed-size stack buffer, producing the stack-based overflow classified under CWE-119 (improper restriction of operations within the bounds of a memory buffer). Successful manipulation of dhcpEn overwrites adjacent stack memory, which can crash the embedded HTTP daemon (denial of service) or, with a carefully constructed payload, redirect control flow inside the firmware process. The affected artifact is identified by CPE cpe:2.3:o:tenda:o3_firmware1.0.0.10\(2478\):*, i.e. the O3 hardware running the specific 1.0.0.10(2478) firmware build; the endpoint is part of the standard device configuration surface rather than a separate optional service, so any build retaining this code path inherits the flaw.
Know when O3 Firmware1 0 0 10 2478 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable DHCP config endpoint (AV:N, AC:L), authenticated low-privilege web access required (PR:L), no scope change (S:U), full C/I/A impact from stack overflow on the device.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was determined in Tenda O3 1.0.0.10(2478). Affected is the function SetValue/GetValue of the file /goform/setDhcpConfig. Executing a manipulation of the argument dhcpEn can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
Executive ViewAI
Tenda O3 outdoor wireless CPE units running firmware 1.0.0.10(2478) expose an authenticated memory-corruption flaw in their web management interface that allows a low-privileged user with valid credentials to take full control of the device, compromising data confidentiality, integrity, and availability. Because these devices typically sit at the network edge - at branch sites, in field deployments, or on customer-facing links - a compromise can serve as a foothold into the surrounding network rather than a contained device failure. Leadership should care because the flaw has publicly available exploit code, no vendor-released patch has been identified at time of analysis, and remediation depends on network-level controls the organization must apply itself.
No vendor-released patch identified at time of analysis. Interim mitigations: disable WAN-side/remote management and remove all port-forwarding or UPnP exposure of the web UI; restrict management access to a trusted VLAN or jump host via ACLs; enforce strong, unique credentials and remove default accounts; block or monitor requests to /goform/setDhcpConfig; segment affected devices from production networks; and prioritize replacement of unsupported units.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in O3 Firmware1 0 0 10 2478
View allA vulnerability has been found in Tenda O3 1.0.0.10 and classified as critical. Rated high severity (CVSS 8.7), this vul
A vulnerability, which was classified as critical, was found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7), this
A vulnerability, which was classified as critical, has been found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7),
A vulnerability classified as critical was found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7), this vulnerabilit
Stack-based buffer overflow in the Tenda O3 router firmware build 1.0.0.10(2478) lets authenticated remote attackers cor
Stack-based buffer overflow in the Tenda O3 router firmware 1.0.0.10(2478) allows remote authenticated attackers with lo
Authenticated remote attackers can trigger a stack-based buffer overflow in Tenda O3 firmware 1.0.0.10(2478) by manipula
Stack-based buffer overflow in Tenda O3 firmware 1.0.0.10(2478) allows a remote attacker with low-level authenticated ac
Stack-based buffer overflow in the SetValue/GetValue handler of the /goform/setNetworkService endpoint on Tenda O3 firmw
Exploit-DB