Tenda O3
CVE-2025-12213
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device web/management interface
-
DeliveryAuthenticate with low-privilege credentials
-
ExploitSend crafted setVlanConfig request
-
ExecutionOverflow stack buffer via oversized lan argument
-
ImpactExecute code or crash service on router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the /goform/setVlanConfig endpoint's SetValue/GetValue function and requires sending an overlong value in the 'lan' argument to trigger the stack-based buffer overflow. Per the CVSS 4.0 vector (PR:L), the attacker needs low-level authenticated access to the device management interface, and the device's web/management service must be network-reachable to the attacker (AV:N) - typically LAN-side or an exposed admin interface rather than the public internet by default. Limiting factors: the PR:L authentication requirement and the narrow deployment footprint of the Tenda O3 constrain realistic exposure; only the specific firmware 1.0.0.10(2478) is listed as affected. |
| Impact | Signals are moderate and internally consistent rather than alarming. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw but explicitly requires low-level privileges (PR:L), meaning an attacker needs some authenticated access to the device management interface - not fully unauthenticated. Impact is high across confidentiality, integrity and availability (VC:H/VI:H/VA:H) with no scope change (SC/SI/SA:N), consistent with code execution confined to the device. The E:P (Proof-of-Concept) threat metric and the public GitHub write-up confirm publicly available exploit code exists, but this is NOT the same as active exploitation: the CVE is not listed in CISA KEV, and EPSS is low at 0.80% (55th percentile), indicating no evidence of widespread opportunistic exploitation. The reporting source (VulDB/cna@vuldb.com) and a GitHub PoC suggest security-research disclosure rather than observed in-the-wild attacks. Net: a genuine code-execution bug worth patching on exposed devices, but the PR:L requirement, niche product footprint, low EPSS, and absence from KEV argue against treating it as an emergency relative to unauthenticated internet-facing criticals. Note one caveat: the CPE and PoC reference an 'O3 v2.0' / firmware string that should be verified against the deployed hardware revision, as Tenda router web parameters are frequently reachable without robust authentication in practice, which could make real-world access easier than PR:L implies. |
| Exploit ScenarioDerived | An attacker with access to the Tenda O3 web management interface sends a crafted request to /goform/setVlanConfig with an oversized 'lan' argument, overflowing a stack buffer in the SetValue/GetValue handler. Public exploit code for this overflow is already available on GitHub, lowering the barrier to weaponization. Successful exploitation corrupts the stack to crash the service or execute attacker-controlled code on the router. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Stack-based buffer overflow in Tenda O3 firmware 1.0.0.10(2478) allows a remote attacker with low-level authenticated access to the device management interface to corrupt memory via an overlong 'lan' parameter submitted to the /goform/setVlanConfig endpoint, potentially achieving arbitrary code execution or a denial of service. The issue is confined to a single legacy firmware build of this outdoor bridge/CPE device, and exploitation requires the web management service to be network-reachable plus valid low-privilege credentials (CVSS 4.0 PR:L; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Publicly available exploit code exists (a detailed PoC write-up is published on GitHub), but there is no confirmed actively exploited (CISA KEV) status, and EPSS is low at 0.80% (55th percentile), so real-world risk is moderate and concentrated in deployments where the admin interface is exposed.
RemediationAI
No vendor-released patch has been identified at the time of analysis for Tenda O3 firmware 1.0.0.10(2478); the available vendor reference (https://www.tenda.com.cn/) does not provide a fixed firmware version, so operators should check the vendor site directly for a newer O3 build and upgrade if one is published. Until then, apply compensating controls tailored to the attack path: (1) restrict the device management interface to a trusted management VLAN and block WAN-side access to the embedded web server, since the overflow is only reachable through /goform/setVlanConfig and requires an authenticated session - trade-off is loss of remote administration, which can be restored via a VPN jump host. (2) Disable remote/web management and any VLAN configuration features not actively used, and firewall the /goform/ path with an application-aware rule or WAF signature matching overlong 'lan' parameters - trade-off is that the WAF is bypassable if the attacker reaches the CGI directly, so it should not be the sole control. (3) Enforce strong, unique administrative credentials and audit accounts, because the assessed vector (PR:L) means an attacker needs at least low-privileged device access before the overflow can be triggered. (4) Where the O3 is end-of-life or the use case no longer requires it, replace or decommission the device, as legacy embedded CPEs with unpatched memory-corruption bugs and publicly available PoC code remain attractive targets on flat networks. Monitor device logs for abnormal requests to /goform/setVlanConfig and for unexpected reboots or service crashes, which may indicate exploitation attempts.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2025-12213 is a classic stack-based buffer overflow (CWE-119: improper restriction of operations within the bounds of a memory buffer) in the Tenda O3 wireless bridge/CPE firmware. The vulnerable code resides in the SetValue/GetValue handling routine reached through the web handler /goform/setVlanConfig, which is part of the device's embedded HTTP management service (commonly a BusyBox/goahead-style CGI stack on this product family). The 'lan' argument is copied into a fixed-size stack buffer without length validation; supplying a value longer than the allocated buffer overwrites adjacent stack memory, including saved registers and the return address. Because the flaw lies in the firmware's internet-facing management daemon rather than a client-side component, successful corruption can redirect execution flow to attacker-influenced data (leveraging the MIPS/ARM embedded architecture's typically non-PIE, non-ASLR binary layout) or simply crash the service. The CPE record cpe:2.3:o:tenda:o3_firmware1.0.0.10\(2478\) confirms the affected scope is limited to the O3 firmware build 1.0.0.10(2478); other builds or hardware revisions are not indicated as affected by the available data.
Know when O3 Firmware1 0 0 10 2478 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable management endpoint (AV:N/AC:L) requiring low-privilege authenticated access (PR:L); memory-corruption code execution gives full C/I/A impact confined to the device (S:U).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security vulnerability has been detected in Tenda O3 1.0.0.10(2478). This vulnerability affects the function SetValue/GetValue of the file /goform/setVlanConfig. Such manipulation of the argument lan leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Executive ViewAI
Organizations using Tenda O3 outdoor bridge/CPE devices with firmware version 1.0.0.10(2478) face a high-severity stack-based buffer overflow in the web management interface, which requires network reachability and valid low-privilege credentials to exploit. Publicly available exploit code exists, but no active exploitation has been confirmed; the primary risk is to exposed management interfaces where an attacker could achieve arbitrary code execution or denial of service. Leadership should prioritize restricting access to these devices and planning for replacement, as no vendor-released patch has been identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include: restricting management interface access to trusted networks only (remove internet exposure, use VPN, firewall ACLs); enforcing strong unique credentials and disabling default accounts; monitoring for exploitation attempts on /goform/setVlanConfig; isolating affected devices on separate VLANs; and replacing or upgrading the device to a supported model.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in O3 Firmware1 0 0 10 2478
View allA vulnerability has been found in Tenda O3 1.0.0.10 and classified as critical. Rated high severity (CVSS 8.7), this vul
A vulnerability, which was classified as critical, was found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7), this
A vulnerability, which was classified as critical, has been found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7),
A vulnerability classified as critical was found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7), this vulnerabilit
Stack-based buffer overflow in the Tenda O3 router firmware build 1.0.0.10(2478) lets authenticated remote attackers cor
Stack-based buffer overflow in the HTTP management interface of Tenda O3 firmware 1.0.0.10(2478) lets a low-privileged,
Stack-based buffer overflow in the Tenda O3 router firmware 1.0.0.10(2478) allows remote authenticated attackers with lo
Authenticated remote attackers can trigger a stack-based buffer overflow in Tenda O3 firmware 1.0.0.10(2478) by manipula
Stack-based buffer overflow in the SetValue/GetValue handler of the /goform/setNetworkService endpoint on Tenda O3 firmw
Exploit-DB