Tenda O3
CVE-2025-12212
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to device web interface
-
DeliverySend crafted /goform/setNetworkService request
-
ExploitOverflow stack buffer via upnpEn argument
-
ExecutionHijack control flow / corrupt memory
-
ImpactExecute code or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Tenda O3 device's web management interface plus low-privilege authentication (CVSS PR:L) - an attacker must send a request to the /goform/setNetworkService endpoint with an oversized/malformed 'upnpEn' argument to overflow the stack buffer in the SetValue/GetValue function. Limiting factors: the PR:L requirement means a valid (even low-privilege) session or working credentials are needed rather than fully anonymous access, and the management interface must be reachable from the attacker's position; the flaw is specific to the 1.0.0.10(2478) firmware revision, and impact is confined to the device itself (SC/SI/SA:N, no scope change). No user interaction is required (UI:N). |
| Impact | This is a stack-based buffer overflow (CWE-119) in the SetValue/GetValue handler of /goform/setNetworkService on Tenda O3 firmware, reachable via the upnpEn parameter. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates a network-reachable, low-complexity attack requiring low-level authentication, with high impact to confidentiality, integrity, and availability of the device itself (no scope/subsequent-system change). Publicly available exploit code exists (GitHub PoC referenced by NVD), which raises practical risk, but EPSS is only 0.80% (55th percentile) and the CVE is NOT on CISA KEV, so there is no evidence of active, widespread exploitation at time of analysis. The PR:L requirement is a meaningful limiter: an attacker needs at least low-privilege authenticated access to the device web interface (e.g., a valid session or default/weak credentials), not purely anonymous network access. Net assessment: a credible, PoC-backed memory-corruption bug in a niche IoT CPE device - worth patching/mitigating where these devices are exposed, but not an emergency mass-exploitation priority given low EPSS, no KEV listing, authentication requirement, and small deployment footprint. Note: the CVE record names 'O3 1.0.0.10(2478)' while the PoC reference path reads 'O3v2.0' - verify the exact affected hardware/firmware revision with the vendor. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the Tenda O3 web management interface (reachable over the network) sends a crafted request to /goform/setNetworkService with an oversized upnpEn argument, overflowing a stack buffer in the SetValue/GetValue handler. A public proof-of-concept is already available, lowering the barrier to triggering the crash or attempting code execution. Because the device is network-facing, this can be performed remotely wherever the management interface is accessible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Stack-based buffer overflow in the SetValue/GetValue handler of the /goform/setNetworkService endpoint on Tenda O3 firmware 1.0.0.10(2478) lets an authenticated low-privilege attacker who can reach the device's web management interface overwrite stack memory by sending an oversized upnpEn argument, yielding complete loss of confidentiality, integrity, and availability on the device itself (assessed CVSS:3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Publicly available exploit code exists, including a GitHub proof-of-concept and a VULDB submission, but the issue is not listed in CISA KEV and EPSS is 0.80% (55th percentile), so active exploitation is not confirmed. Because the CVSS vector specifies PR:L, a valid low-privilege session or working credentials are needed rather than fully anonymous access, and the management interface must be network-reachable.
RemediationAI
No vendor-released patch identified at time of analysis for Tenda O3 1.0.0.10(2478); check https://www.tenda.com.cn/ (and the VULDB entries https://vuldb.com/?id.329882 and https://vuldb.com/?ctiid.329882) for a fixed firmware image before applying, and back up the configuration first because a firmware upgrade resets or migrates settings. Until a fixed build is confirmed, restrict the attack surface by blocking access to the device's HTTP management interface from WAN and from untrusted VLANs or guest networks (place the O3 on an isolated management segment), which prevents the remote reachability the vector assumes but removes remote administration convenience. Disable UPnP and any remote/web management features in the O3 web UI if the firmware exposes such toggles, accepting that this may break automatic port mapping for downstream clients. Enforce unique, strong administrator credentials and, where the firmware permits, least-privilege accounts, since the assessed vector requires only low-privilege authentication (PR:L); this raises the bar but does not eliminate the bug for an insider or a credential-stuffed session. Monitor HTTP logs and IDS signatures for POST requests to /goform/setNetworkService containing abnormally long upnpEn values, and treat such events as exploitation attempts; long-term, replace the device if the vendor does not issue firmware, as the publicly available exploit code lowers the effort required for opportunistic attacks.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-119 improper restriction of operations within the bounds of a memory buffer, manifesting as a stack-based buffer overflow in the Tenda O3 embedded web server. The affected HTTP handler lives at /goform/setNetworkService and routes the request parameter upnpEn through internal SetValue/GetValue routines that copy attacker-supplied data into a fixed-size stack buffer without length validation. Tenda consumer/ISP CPE firmware of this generation typically runs a small embedded Linux/BusyBox stack exposing goform-style CGI endpoints, and this handler is part of the UPnP-related network service configuration surface. The CPE string cpe:2.3:o:tenda:o3_firmware1.0.0.10\(2478\) locks the affected code base to that specific firmware revision, so the vulnerable function may not be present or may differ in later or earlier builds. Because the CVSS scope and subsequent-system metrics are S:U/SC:N/SI:N/SA:N, exploitation is contained to the O3 device and does not demonstrably pivot into other components, though a successful overflow on an embedded router-class device commonly yields code execution in the context of the web daemon and therefore full device control.
Know when O3 Firmware1 0 0 10 2478 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web endpoint (AV:N/AC:L), authenticated low-privilege access needed per input vector (PR:L), no user interaction (UI:N); buffer overflow yields full device compromise (C/I/A:H, scope unchanged).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A weakness has been identified in Tenda O3 1.0.0.10(2478). This affects the function SetValue/GetValue of the file /goform/setNetworkService. This manipulation of the argument upnpEn causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Executive ViewAI
A high-severity stack-based buffer overflow in Tenda O3 routers running firmware 1.0.0.10(2478) allows an attacker with valid low-privilege credentials and network access to the management interface to fully take over the device, wiping out its confidentiality, integrity, and availability. Publicly available exploit code exists and no vendor patch has been identified, so any organization with these devices exposed on its network - particularly at branch or edge locations - carries unmitigated risk until the units are isolated or replaced. Leadership should treat this as an asset-exposure and network-segmentation issue rather than a purely technical defect, since a compromised router can serve as a foothold into the surrounding network.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict web management interface access to a trusted management VLAN or IP allowlist, disable WAN-side/remote administration and UPnP, enforce strong unique admin credentials and rotate them, isolate affected Tenda O3 devices via firewall/segmentation rules, monitor and alert on management-interface authentication and access events, and plan hardware replacement for unpatchable units.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in O3 Firmware1 0 0 10 2478
View allA vulnerability has been found in Tenda O3 1.0.0.10 and classified as critical. Rated high severity (CVSS 8.7), this vul
A vulnerability, which was classified as critical, was found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7), this
A vulnerability, which was classified as critical, has been found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7),
A vulnerability classified as critical was found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7), this vulnerabilit
Stack-based buffer overflow in the Tenda O3 router firmware build 1.0.0.10(2478) lets authenticated remote attackers cor
Stack-based buffer overflow in the HTTP management interface of Tenda O3 firmware 1.0.0.10(2478) lets a low-privileged,
Stack-based buffer overflow in the Tenda O3 router firmware 1.0.0.10(2478) allows remote authenticated attackers with lo
Authenticated remote attackers can trigger a stack-based buffer overflow in Tenda O3 firmware 1.0.0.10(2478) by manipula
Stack-based buffer overflow in Tenda O3 firmware 1.0.0.10(2478) allows a remote attacker with low-level authenticated ac
Exploit-DB