Tenda O3
CVE-2025-12211
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web interface
-
DeliverySend crafted POST to /goform/setDmzInfo
-
ExploitOverflow stack buffer via oversized dmzIP
-
ExecutionExecute code or crash device
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach and authenticate to the Tenda O3 router's HTTP management interface (CVSS PR:L) and to invoke the DMZ configuration function at /goform/setDmzInfo (SetValue/GetValue) with an overlong dmzIP parameter. The limiting factors are: valid low-privilege web-interface credentials or session are needed (not fully unauthenticated), and network reachability of the admin interface - typically LAN-side on consumer routers unless remote management is explicitly enabled, which narrows realistic exposure. No end-user interaction is required once interface access is obtained. |
| Impact | Signals are moderately consistent and point to a real but not top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, VC/VI/VA:H) describes a network-reachable, low-complexity flaw requiring low-level authentication that fully compromises the device, and the vendor-supplied E:P confirms a proof-of-concept exists, which matches the publicly released exploit referenced on GitHub. However, the EPSS score is low at 0.84% (56th percentile), indicating no evidence of widespread automated exploitation activity, and the CVE is NOT listed in CISA KEV, so there is no confirmation of active in-the-wild exploitation. The PR:L requirement is a meaningful limiter: an attacker needs valid (even low-privilege) access to the router's web interface, which on SOHO/consumer devices often means LAN access or a weak/default credential rather than fully unauthenticated internet exploitation. Net: a genuine, exploitable memory-corruption bug with public exploit code, but the low EPSS, absence from KEV, and authentication prerequisite place it as a patch-when-reasonable issue rather than an emergency, especially given the niche affected product. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the Tenda O3 web management interface (e.g., over the LAN or via weak credentials) sends a crafted request to /goform/setDmzInfo containing an oversized dmzIP value, overflowing a stack buffer in the SetValue/GetValue handler. This corrupts the stack to crash the device or execute attacker-controlled code with the firmware's privileges. A public proof-of-concept exploit for this exact endpoint has been released, lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Stack-based buffer overflow in the Tenda O3 router firmware 1.0.0.10(2478) allows remote authenticated attackers with low-privilege web-interface credentials to corrupt memory, and potentially execute code or crash the device, by sending an overlong dmzIP parameter to the /goform/setDmzInfo endpoint. Publicly available exploit code exists (referenced GitHub PoC), though the CVE is not in CISA KEV and EPSS is 0.84% (56th percentile), indicating a real but not top-tier priority. Reachability is constrained because exploitation requires access to the router's HTTP management interface, typically LAN-side unless remote management is explicitly enabled, and authentication is required per the assessed CVSS vector (PR:L).
RemediationAI
No vendor-released patch identified at time of analysis, so remediation must rely on exposure reduction and compensating controls. Disable remote/WAN administration and restrict HTTP/HTTPS management access to trusted LAN hosts via firewall rules or VLAN ACLs, and ensure only strong non-default administrative credentials are used; this blocks the most likely attack path but assumes the attacker is not already on the trusted segment. If DMZ functionality is not required, disable the DMZ feature entirely, which removes the /goform/setDmzInfo attack surface but changes routing behavior for any existing DMZ host. Where DMZ must remain, deploy an upstream WAF or router ACL that rejects requests to /goform/setDmzInfo carrying unusually long dmzIP values; this heuristic filtering may be bypassed with encoding variants and requires ongoing tuning. Monitor Tenda's site (https://www.tenda.com.cn/) and the VulDB references for a firmware update, and treat the router as potentially compromised if an attacker had management-plane access.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic CWE-119 memory-buffer bounds violation in the DMZ configuration handler of the Tenda O3 embedded firmware. The /goform/setDmzInfo endpoint's SetValue/GetValue routines copy the user-supplied dmzIP argument into a fixed-length stack buffer without length validation, so an oversized value overwrites adjacent stack memory. The affected component is the specific firmware image represented by CPE cpe:2.3:o:tenda:o3_firmware1.0.0.10\(2478\):*:*:*:*:*:*:*:*, i.e., a consumer router running a monolithic firmware build where the vulnerable handler is present by default. Public IoT vulnerability research, reflected in the referenced GitHub PoC, demonstrates the overflow against this model, and the VulDB tags and CPE mapping confirm the product/version association. Because the vulnerable code resides in a configuration parser on the management plane, the flaw sits at the intersection of buffer-overflow bug classes and IoT router attack surface.
Know when O3 Firmware1 0 0 10 2478 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web endpoint (AV:N/AC:L/UI:N) requiring low-privilege authentication to the router interface (PR:L); stack overflow yields full code-execution impact (C/I/A:H), scope unchanged.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security flaw has been discovered in Tenda O3 1.0.0.10(2478). Affected by this issue is the function SetValue/GetValue of the file /goform/setDmzInfo. The manipulation of the argument dmzIP results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Executive ViewAI
Tenda O3 routers running firmware 1.0.0.10(2478) are affected by a high-severity memory corruption issue that an authenticated low-privilege user could trigger through the device's management interface, potentially causing a crash or code execution. Publicly available exploit code exists and no vendor-released patch identified at time of analysis, creating unmitigated risk to network availability and possible device compromise, especially where remote management is enabled. Leadership should prioritize inventorying, isolating, and planning replacement of these routers until a patch or supported alternative is available.
No vendor-released patch identified at time of analysis; disable remote management, restrict the management interface to trusted VLANs or IPs, enforce strong unique credentials, segment affected routers from critical systems, monitor for /goform/setDmzInfo abuse, and plan replacement or upgrade once a patched firmware version is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in O3 Firmware1 0 0 10 2478
View allA vulnerability has been found in Tenda O3 1.0.0.10 and classified as critical. Rated high severity (CVSS 8.7), this vul
A vulnerability, which was classified as critical, was found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7), this
A vulnerability, which was classified as critical, has been found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7),
A vulnerability classified as critical was found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7), this vulnerabilit
Stack-based buffer overflow in the Tenda O3 router firmware build 1.0.0.10(2478) lets authenticated remote attackers cor
Stack-based buffer overflow in the HTTP management interface of Tenda O3 firmware 1.0.0.10(2478) lets a low-privileged,
Authenticated remote attackers can trigger a stack-based buffer overflow in Tenda O3 firmware 1.0.0.10(2478) by manipula
Stack-based buffer overflow in Tenda O3 firmware 1.0.0.10(2478) allows a remote attacker with low-level authenticated ac
Stack-based buffer overflow in the SetValue/GetValue handler of the /goform/setNetworkService endpoint on Tenda O3 firmw
Exploit-DB