EUVD-2025-21074Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents HIGH real-world risk despite being classified as critical. Signal analysis: (1) CVSS 8.8 with network-accessible vector (AV:N) and low complexity (AC:L) indicates ease of exploitation; (2) Low privilege requirement (PR:L) means post-authentication exploitation, reducing opportunistic attack surface but increasing insider/compromised-credential risk; (3) Public exploit disclosure (confirmed in CVE description) combined with proof-of-concept availability significantly increases exploitation probability—EPSS scoring would likely be elevated (typically 60-90% range for public POCs on critical flaws); (4) KEV/CISA tracking status unknown from provided data but public POC disclosure is a KEV inclusion indicator; (5) Stack overflow leading to RCE with full impact (C:H/I:H/A:H) satisfies SSVC critical criteria. PRIORITY: HIGH—actively exploited malware/APT toolkits likely incorporate this given disclosure status and network-accessible nature on IoT/networking devices commonly targeted. |
| Exploit ScenarioDerived | An attacker with valid credentials (or who has compromised credentials through phishing/credential reuse) authenticates to the Tenda O3V2 device's web interface. The attacker crafts a malicious HTTP POST request to /goform/setSysTimeInfo with an oversized Time parameter containing shellcode and ROP gadget chains. The httpd daemon's fromSysToolTime function copies this payload into a fixed-size stack buffer without bounds checking, overflowing the return address. Control flow is hijacked to execute arbitrary code with the privileges of the httpd process (typically root on embedded devices). Result: Device compromise, lateral network movement, data exfiltration, or botnet recruitment. Given public POC availability, automated exploitation via mass scanning tools is probable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
A critical stack-based buffer overflow vulnerability exists in Tenda O3V2 1.0.0.12(3880) in the httpd component's fromSysToolTime function within /goform/setSysTimeInfo. An authenticated remote attacker can exploit this by manipulating the Time argument to achieve arbitrary code execution with high confidentiality, integrity, and availability impact (CVSS 8.8). Public exploit disclosure and active exploitation indicators elevate real-world risk significantly.
RemediationAI
Immediate mitigation steps: (1) If a patched firmware version is available from Tenda, apply it immediately—contact Tenda support or check their firmware download page for O3V2 builds newer than 1.0.0.12(3880); (2) Restrict network access to /goform/setSysTimeInfo endpoint via WAF, firewall rules, or disable the httpd service if not required; (3) Implement strong authentication controls to prevent unauthorized account access (limits PR:L exploitation path); (4) Segment affected O3V2 devices on isolated VLANs if they must remain operational; (5) Monitor for exploit indicators in httpd logs (malformed Time parameter submissions, buffer patterns); (6) As a last resort, replace the O3V2 device with a patched alternative if vendor remediation is unavailable. Vendor patch ETA should be requested from Tenda immediately.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in a network-accessible HTTP daemon (httpd) endpoint handling system time configuration. The fromSysToolTime function fails to implement proper bounds checking on user-supplied Time parameter input before copying it into a stack buffer. This is a classic CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerability enabling stack smashing attacks. The affected CPE is cpe:2.3:o:tenda:o3v2_firmware:1.0.0.12\(3880\):*:*:*:*:*:*:*. The httpd component processes unauthenticated HTTP requests, but requires authenticated access (PR:L in CVSS vector), suggesting the vulnerability is exploitable post-authentication or through credential compromise.
Know when O3 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability, which was classified as critical, was found in Tenda O3V2 1.0.0.12(3880). Affected is the function fromSysToolTime of the file /goform/setSysTimeInfo of the component httpd. The manipulation of the argument Time leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
A critical remote code execution vulnerability affects Tenda O3V2 routers (version 1.0.0.12) with no vendor patch currently available. Organizations using this device model face immediate risk of unauthorized network access and potential compromise of connected systems, as public exploits are already circulating.
Implement Web Application Firewall (WAF) rules to block requests to /goform/setSysTimeInfo endpoint; restrict administrative access to device management interfaces via network segmentation and ACLs; disable remote management features if not required; deploy IDS/IPS signatures for exploitation attempts; monitor for suspicious process execution and network connections from affected devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
More in O3 Firmware
View allTenda O3V2 v1.0.0.12(3880) was discovered to contain a Blind Command Injection via stpEn parameter in the SetStp functio
CVE-2025-7423 is a critical stack-based buffer overflow vulnerability in Tenda O3V2 router firmware (version 1.0.0.12(38
A buffer overflow vulnerability in A vulnerability classified as critical (CVSS 8.8). Risk factors: public PoC available
A critical stack-based buffer overflow vulnerability exists in Tenda O3V2 firmware version 1.0.0.12(3880) in the MAC fil
CVE-2025-7420 is a critical stack-based buffer overflow vulnerability in Tenda O3V2 router firmware (version 1.0.0.12(38
A critical stack-based buffer overflow vulnerability exists in Tenda O3V2 router firmware version 1.0.0.12(3880), affect
A buffer overflow vulnerability in A vulnerability (CVSS 8.8). Risk factors: public PoC available.
CVE-2025-7417 is a critical stack-based buffer overflow vulnerability in Tenda O3V2 router firmware (version 1.0.0.12(38
A vulnerability was found in Tenda O3 1.0.0.10(2478). Rated high severity (CVSS 8.7), this vulnerability is remotely exp
A vulnerability was found in Tenda O3 1.0.0.10(2478). Rated high severity (CVSS 8.7), this vulnerability is remotely exp
Tenda O3V2 with firmware versions V1.0.0.10 and V1.0.0.12 was discovered to contain a Blind Command Injection via dest p
Buffer Overflow vulnerability in Tenda O3 v.1.0.0.5 allows a remote attacker to cause a denial of service via a network
Exploit-DB