O3 Firmware CVE-2025-7420

This vulnerability presents HIGH real-world risk based on multiple converging signals: (1) CVSS 8.8 with Network access vector and Low privilege requirement indicates broad attack surface—any authenticated user on the network can trigger exploitation; (2) Public proof-of-concept code availability significantly increases exploitation probability and enables both targeted attacks and mass scanning campaigns; (3) Stack-based buffer overflow with code execution impact (C:H, I:H, A:H) represents complete system takeover potential; (4) Embedded router firmware typically has no modern mitigations (ASLR, DEP, stack canaries) reducing exploitation difficulty; (5) Authentication requirement (PR:L) is a limiting factor but not sufficient protection since many home networks have weak WiFi passwords or administrative defaults. SSVC considerations: exploitation is PoC-available (public), automatable across many vulnerable devices, with critical technical impact. This should be treated as actively exploitable despite the authentication gate. Real-world priority is CRITICAL for organizations managing Tenda router fleets.

An attacker with valid WiFi credentials (either obtained through weak pre-shared key brute-force or shared network access) logs into the Tenda O3V2 router's web interface at 192.168.0.1. The attacker then crafts a POST request to /goform/setWrlBasicInfo with an oversized 'extChannel' parameter containing a malicious ROP gadget chain or shell code. The httpd daemon receives the request, the formWifiBasicSet function attempts to strcpy() the attacker's extChannel value into a fixed-size stack buffer without length validation, overwriting the function's return address and adjacent stack memory. Execution flow is redirected to attacker-controlled code, which could: (1) spawn a reverse shell for persistent access, (2) exfiltrate WiFi credentials and connected device information, (3) inject firmware patches to maintain persistence across reboots, (4) use the compromised router as a pivot point for lateral network movement. Since a public PoC exists, an attacker can automate scanning for vulnerable Tenda O3V2 devices via web fingerprinting, then mass-exploit all discovered instances. The low attack complexity (AC:L) and network vector (AV:N) mean exploitation can be launched from any network vantage point once WiFi access is obtained.