Tenda O3
CVE-2025-12210
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web UI
-
DeliverySend crafted /goform/AdvSetLanip request
-
ExploitOverflow stack buffer via lanIp arg
-
ExecutionExecute code or crash device
-
ImpactCompromise router / disrupt network
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to the router's HTTP management interface and, per the CVSS PR:L metric, valid authenticated credentials to reach the /goform/AdvSetLanip endpoint. Exploitation targets the specific Tenda O3 firmware build 1.0.0.10(2478); the SetValue/GetValue handler must process the attacker-supplied lanIp parameter without bounds checking. Limiting factors: authentication is needed (not a pre-auth flaw), the management interface must be reachable from the attacker's position (typically LAN or an exposed WAN admin panel), and successful arbitrary code execution - as opposed to a device crash - is not independently confirmed. |
| Impact | This is a stack-based buffer overflow (CWE-119) in the SetValue/GetValue handler of /goform/AdvSetLanip on Tenda O3 router firmware 1.0.0.10(2478), triggered via the lanIp argument. Signals are moderately consistent: the vendor CVSS 4.0 base score of 7.4 uses AV:N/AC:L/PR:L (network-reachable but authenticated) with full VC:H/VI:H/VA:H impact, and a public exploit exists (GitHub PoC by noahze01), which is why E:P (Proof-of-Concept) is set. EPSS is 1.08% at the 64th percentile - non-trivial but not indicative of mass exploitation - and the CVE is NOT on CISA KEV, so despite public PoC availability there is no confirmed active exploitation. The realistic risk is bounded by two factors the raw score understates: (1) PR:L means an attacker needs valid credentials to the router's web interface, and (2) the impact is a VulDB-reported stack overflow where reliable remote code execution on the embedded target is plausible but unconfirmed - many such reports manifest as denial-of-service in practice. Note a data discrepancy: the CPE and description name firmware 1.0.0.10(2478) while the exploit reference path is 'O3v2.0' - verify the exact affected build with the vendor. |
| Exploit ScenarioDerived | An attacker with access to the router's web management interface sends a crafted request to /goform/AdvSetLanip with an oversized lanIp value, overflowing a stack buffer in the SetValue/GetValue handler. This can crash the device (DoS) or, if the overflow is controllable, execute arbitrary code on the router. A public proof-of-concept for this exact endpoint is available on GitHub. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Stack-based buffer overflow in the Tenda O3 router firmware build 1.0.0.10(2478) lets authenticated remote attackers corrupt stack memory through a crafted lanIp value submitted to the /goform/AdvSetLanip web endpoint, potentially achieving code execution or forcing a device crash/reboot. Exploitation requires network reachability to the router's HTTP management interface and, per the CVSS PR:L metric, valid credentials; the flaw is not pre-authentication. Publicly available proof-of-concept exploit code exists (E:P in the CVSS v4.0 vector, plus a GitHub write-up), and EPSS sits at roughly 1.08% (64th percentile), indicating moderate but not elevated real-world targeting; there is no CISA KEV listing, so active exploitation is not confirmed.
RemediationAI
No vendor-released patch was identified at time of analysis, and no fixed firmware version is documented in the supplied references, so remediation must initially rely on compensating controls. First, remove the router's management interface from untrusted exposure: disable WAN-side/remote administration and ensure the HTTP admin panel is reachable only from a trusted LAN segment - the trade-off is loss of convenient remote configuration. Second, enforce strong, non-default administrative credentials and rotate them, since the CVSS PR:L metric means valid login is a prerequisite; weak or shared passwords materially lower the bar for this attack, and the trade-off is added credential-management overhead. Third, segment IoT/edge devices onto an isolated VLAN with strict egress and management-plane ACLs so a compromised router cannot pivot into the corporate network, accepting increased network complexity. Fourth, monitor and alert on oversized or malformed requests to /goform/AdvSetLanip, on repeated device reboots, and on unexpected outbound traffic from the router, which may indicate exploitation attempts; this is detective rather than preventive. Where a patched build is ultimately published by Tenda, apply it immediately; users should check the vendor site (https://www.tenda.com.cn/) and the referenced VulDB entries (https://vuldb.com/?id.329880) for status updates, since the absence of a patch in the available data is not confirmation that none will be issued.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2025-12210 is a memory-safety defect in the class CWE-119 (improper restriction of operations within the bounds of a memory buffer), manifesting specifically as a stack-based buffer overflow. Tenda O3 firmware exposes a Boa-style embedded HTTP configuration service whose goform endpoints - here /goform/AdvSetLanip - dispatch through SetValue/GetValue handlers that write user-supplied form fields into fixed-size stack buffers. The lanIp argument, which normally carries a dotted-quad LAN IP address, is copied without adequate length validation, so an over-long value overruns adjacent stack memory, including saved registers and the return address. Because this is an embedded MIPS-class device, successful corruption can lead to arbitrary code execution in the context of the web server or, more commonly, a crash and reboot. The affected product is identified by CPE cpe:2.3:o:tenda:o3_firmware:1.0.0.10\(2478\), tying the issue to one specific firmware build rather than the hardware family as a whole. The CVSS v4.0 score of 7.4 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) aligns with the independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): the attack is network-delivered and low-complexity, but requires low-privilege authenticated access rather than being unauthenticated. The E:P threat metric reflects the public exploit rather than confirmed in-the-wild activity.
Know when O3 Firmware1 0 0 10 2478 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web endpoint (AV:N/AC:L) but requires authenticated access (PR:L per vendor vector); stack overflow on embedded device plausibly yields full CIA compromise if RCE is achieved.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was identified in Tenda O3 1.0.0.10(2478). Affected by this vulnerability is the function SetValue/GetValue of the file /goform/AdvSetLanip. The manipulation of the argument lanIp leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
Executive ViewAI
The Tenda O3 router (firmware build 1.0.0.10(2478)) contains a high-severity stack buffer overflow that requires valid credentials and network access to the HTTP management interface. A publicly available exploit could allow an authenticated attacker to corrupt memory, potentially achieving code execution or causing device crashes, which may disrupt network availability or serve as a foothold for lateral movement. Leadership should prioritize remediation because these routers often sit at network edges, and a compromise could expose sensitive internal systems or degrade critical connectivity.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict HTTP management interface access to trusted networks/IPs, enforce strong unique credentials, disable remote management, segment affected routers on isolated VLANs, monitor for exploitation attempts targeting /goform/AdvSetLanip, and prepare for device replacement or vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in O3 Firmware1 0 0 10 2478
View allA vulnerability has been found in Tenda O3 1.0.0.10 and classified as critical. Rated high severity (CVSS 8.7), this vul
A vulnerability, which was classified as critical, was found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7), this
A vulnerability, which was classified as critical, has been found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7),
A vulnerability classified as critical was found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7), this vulnerabilit
Stack-based buffer overflow in the HTTP management interface of Tenda O3 firmware 1.0.0.10(2478) lets a low-privileged,
Stack-based buffer overflow in the Tenda O3 router firmware 1.0.0.10(2478) allows remote authenticated attackers with lo
Authenticated remote attackers can trigger a stack-based buffer overflow in Tenda O3 firmware 1.0.0.10(2478) by manipula
Stack-based buffer overflow in Tenda O3 firmware 1.0.0.10(2478) allows a remote attacker with low-level authenticated ac
Stack-based buffer overflow in the SetValue/GetValue handler of the /goform/setNetworkService endpoint on Tenda O3 firmw
Exploit-DB