What is the CVSS score of CVE-2025-7422?

CVE-2025-7422 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of O3 Firmware are affected by CVE-2025-7422?

A critical remote code execution vulnerability exists in Tenda O3V2 routers (version 1.0.0.12) that allows attackers to compromise devices without authentication.

Is there a public PoC exploit available for CVE-2025-7422?

Yes, a public proof-of-concept exploit is available for CVE-2025-7422. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2025-7422?

Within 24 hours: Inventory all Tenda O3V2 devices in production and isolate them to a segregated network segment if possible; notify all stakeholders of the vulnerability. Within 7 days: Implement network access controls restricting httpd traffic on port 80/443 to authorized IPs only; disable the setNetworkService functionality if not business-critical; monitor for exploitation attempts. Within 30 days: Replace affected Tenda O3V2 devices with alternative equipment from vendors with active security support, or wait for official patch confirmation and immediately deploy when available.

O3 Firmware CVE-2025-7422

EUVD-2025-21098 HIGH

Buffer Overflow (CWE-119)

2025-07-11 cna@vuldb.com

Buffer Overflow Tenda O3 Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 08:17 euvd

EUVD-2025-21098

Analysis Generated

Mar 16, 2026 - 08:17 vuln.today

PoC Detected

Jul 16, 2025 - 16:43 vuln.today

Public exploit code

CVE Published

Jul 11, 2025 - 01:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability classified as critical has been found in Tenda O3V2 1.0.0.12(3880). Affected is the function setAutoReboot of the file /goform/setNetworkService of the component httpd. The manipulation of the argument week leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.