EUVD-2025-21090CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability was found in Tenda O3V2 1.0.0.12(3880). It has been rated as critical. This issue affects the function fromMacFilterModify of the file /goform/operateMacFilter of the component httpd. The manipulation of the argument mac leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Analysis
A critical stack-based buffer overflow vulnerability exists in Tenda O3V2 firmware version 1.0.0.12(3880) in the MAC filter modification function. An authenticated remote attacker can exploit improper input validation of the 'mac' parameter to achieve remote code execution with full system compromise (confidentiality, integrity, and availability impact). The vulnerability has public exploit disclosure and demonstrates high real-world exploitability.
Technical Context
The vulnerability resides in the httpd web server component of Tenda O3V2 router firmware, specifically in the fromMacFilterModify function handling requests to /goform/operateMacFilter. The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), manifesting as a classic stack-based buffer overflow. The mac parameter undergoes insufficient bounds checking before being written to a stack-allocated buffer, allowing an attacker to overflow the buffer and overwrite the stack frame, including return addresses and saved registers. This is a memory safety issue common in C/C++ firmware implementations lacking modern protections. The affected product is a wireless mesh router system where httpd processes user requests, making this directly network-accessible after authentication.
Affected Products
Tenda O3V2 (['1.0.0.12(3880)'])
Remediation
Contact Tenda support or check their official website for firmware updates beyond version 1.0.0.12(3880). Firmware updates should include bounds checking fixes in the fromMacFilterModify function.; priority: Critical - Apply immediately Workaround: Restrict access to the router's web interface (httpd) to trusted networks only. Disable remote management if enabled. Use a firewall rule to block external access to the management interface (typically port 80/443).; priority: Temporary mitigation pending patch Detection: Monitor httpd logs for unusual requests to /goform/operateMacFilter endpoint, especially those with oversized or malformed 'mac' parameter values. Look for stack traces or unexpected service crashes.; priority: Ongoing Access Control: Enforce strong authentication credentials on router admin accounts and disable default credentials. Limit which devices/users can authenticate to the router.; priority: High
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today