O3 Firmware EUVD-2025-21073

This vulnerability presents a HIGH real-world risk despite requiring authentication (PR:L in CVSS vector). Risk signal analysis: (1) CVSS 8.8 reflects high severity with network accessibility (AV:N), low attack complexity (AC:L), and complete system compromise potential (C:H/I:H/A:H); (2) Authentication requirement (PR:L) moderately reduces opportunistic attack surface but is not a significant barrier if default credentials, credential disclosure, or guest access exists on Tenda routers; (3) Public POC availability dramatically increases exploitation probability and lowers barrier to entry for threat actors; (4) No KEV or EPSS data provided, but disclosure-to-exploit timeline is already crossed (POC public); (5) Stack-based buffer overflows are reliably exploitable on embedded devices with limited modern protections (ASLR/DEP often absent on router firmware); (6) Router compromise enables lateral network movement, credential harvesting, and persistent access. This is NOT a false-positive high-CVSS issue—it is genuinely critical for affected deployments. SSVC assessment: Exploitation=Active (POC public), Automatable=Yes (memory corruption is reliably exploitable), Technical Impact=Complete (arbitrary code execution), therefore Priority=Critical.

An attacker with valid router credentials (obtained via phishing, default credentials, or prior compromise) authenticates to the Tenda O3V2 web interface. The attacker crafts an HTTP request to /goform/setPingInfo with a maliciously long 'ip' parameter (e.g., 200+ bytes of controlled data including ROP gadgets or shellcode). The fromNetToolGet function copies this input into a fixed-size stack buffer without bounds checking, corrupting the stack frame. The attacker can overwrite the saved return address to point to injected shellcode or a ROP chain, gaining arbitrary code execution within the httpd process context (root/admin privileges on typical routers). From there, the attacker: (1) establishes persistent backdoor access, (2) exfiltrates traffic or credentials, (3) pivots to internal network hosts, or (4) weaponizes the router as a botnet node. A public POC likely includes a pre-built payload, allowing unsophisticated attackers to execute this within minutes. Timeline to widespread exploitation: days to weeks given POC availability and Tenda router installed base.