EUVD-2025-21074CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability, which was classified as critical, was found in Tenda O3V2 1.0.0.12(3880). Affected is the function fromSysToolTime of the file /goform/setSysTimeInfo of the component httpd. The manipulation of the argument Time leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
A critical stack-based buffer overflow vulnerability exists in Tenda O3V2 1.0.0.12(3880) in the httpd component's fromSysToolTime function within /goform/setSysTimeInfo. An authenticated remote attacker can exploit this by manipulating the Time argument to achieve arbitrary code execution with high confidentiality, integrity, and availability impact (CVSS 8.8). Public exploit disclosure and active exploitation indicators elevate real-world risk significantly.
Technical Context
The vulnerability resides in a network-accessible HTTP daemon (httpd) endpoint handling system time configuration. The fromSysToolTime function fails to implement proper bounds checking on user-supplied Time parameter input before copying it into a stack buffer. This is a classic CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerability enabling stack smashing attacks. The affected CPE is cpe:2.3:o:tenda:o3v2_firmware:1.0.0.12\(3880\):*:*:*:*:*:*:*. The httpd component processes unauthenticated HTTP requests, but requires authenticated access (PR:L in CVSS vector), suggesting the vulnerability is exploitable post-authentication or through credential compromise.
Affected Products
Tenda O3V2 firmware version 1.0.0.12(3880) and potentially related firmware builds. CPE: cpe:2.3:o:tenda:o3v2_firmware:1.0.0.12\(3880\):*:*:*:*:*:*:*. Tenda O3V2 is a wireless mesh networking device commonly deployed in residential/SOHO networks. Related O3V2 firmware versions preceding 1.0.0.12(3880) may also be vulnerable if the vulnerable fromSysToolTime function is present. Vendor advisory and patch information should be sourced from Tenda security bulletins (https://www.tenda.com.cn/ or regional support pages).
Remediation
Immediate mitigation steps: (1) If a patched firmware version is available from Tenda, apply it immediately—contact Tenda support or check their firmware download page for O3V2 builds newer than 1.0.0.12(3880); (2) Restrict network access to /goform/setSysTimeInfo endpoint via WAF, firewall rules, or disable the httpd service if not required; (3) Implement strong authentication controls to prevent unauthorized account access (limits PR:L exploitation path); (4) Segment affected O3V2 devices on isolated VLANs if they must remain operational; (5) Monitor for exploit indicators in httpd logs (malformed Time parameter submissions, buffer patterns); (6) As a last resort, replace the O3V2 device with a patched alternative if vendor remediation is unavailable. Vendor patch ETA should be requested from Tenda immediately.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today