What is the CVSS score of CVE-2025-7416?

CVE-2025-7416 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of O3 Firmware are affected by CVE-2025-7416?

A critical remote code execution vulnerability affects Tenda O3V2 routers (version 1.0.0.12) with no vendor patch currently available.

Is there a public PoC exploit available for CVE-2025-7416?

Yes, a public proof-of-concept exploit is available for CVE-2025-7416. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2025-7416?

Within 24 hours: inventory all Tenda O3V2 1.0.0.12(3880) devices and isolate them from critical network segments; disable WAN access if operationally feasible. Within 7 days: implement WAF rules blocking POST requests to /goform/setSysTimeInfo with oversized Time parameters; segment affected devices to restricted VLANs with egress filtering. Within 30 days: prepare for device replacement or request emergency firmware update from Tenda; evaluate alternative router vendors for future deployments.

O3 Firmware CVE-2025-7416

EUVD-2025-21074 HIGH

Buffer Overflow (CWE-119)

2025-07-10 cna@vuldb.com

Buffer Overflow O3 Firmware Tenda

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 06:52 euvd

EUVD-2025-21074

Analysis Generated

Mar 16, 2026 - 06:52 vuln.today

PoC Detected

Jul 16, 2025 - 15:00 vuln.today

Public exploit code

CVE Published

Jul 10, 2025 - 22:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability, which was classified as critical, was found in Tenda O3V2 1.0.0.12(3880). Affected is the function fromSysToolTime of the file /goform/setSysTimeInfo of the component httpd. The manipulation of the argument Time leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

A critical stack-based buffer overflow vulnerability exists in Tenda O3V2 1.0.0.12(3880) in the httpd component's fromSysToolTime function within /goform/setSysTimeInfo. An authenticated remote attacker can exploit this by manipulating the Time argument to achieve arbitrary code execution with high confidentiality, integrity, and availability impact (CVSS 8.8). Public exploit disclosure and active exploitation indicators elevate real-world risk significantly.

Technical ContextAI

The vulnerability resides in a network-accessible HTTP daemon (httpd) endpoint handling system time configuration. The fromSysToolTime function fails to implement proper bounds checking on user-supplied Time parameter input before copying it into a stack buffer. This is a classic CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerability enabling stack smashing attacks. The affected CPE is cpe:2.3:o:tenda:o3v2_firmware:1.0.0.12\(3880\):*:*:*:*:*:*:*. The httpd component processes unauthenticated HTTP requests, but requires authenticated access (PR:L in CVSS vector), suggesting the vulnerability is exploitable post-authentication or through credential compromise.

RemediationAI

Immediate mitigation steps: (1) If a patched firmware version is available from Tenda, apply it immediately—contact Tenda support or check their firmware download page for O3V2 builds newer than 1.0.0.12(3880); (2) Restrict network access to /goform/setSysTimeInfo endpoint via WAF, firewall rules, or disable the httpd service if not required; (3) Implement strong authentication controls to prevent unauthorized account access (limits PR:L exploitation path); (4) Segment affected O3V2 devices on isolated VLANs if they must remain operational; (5) Monitor for exploit indicators in httpd logs (malformed Time parameter submissions, buffer patterns); (6) As a last resort, replace the O3V2 device with a patched alternative if vendor remediation is unavailable. Vendor patch ETA should be requested from Tenda immediately.