O3 Firmware EUVD-2025-21086

This vulnerability represents genuine critical risk across multiple dimensions: (1) CVSS 8.8 with AV:N (network-accessible), AC:L (low complexity), and PR:L (requires low privilege—authenticated access), resulting in complete confidentiality, integrity, and availability impact; (2) CWE-119 buffer overflows are consistently exploitable and well-understood attack primitives; (3) Public POC availability significantly elevates EPSS exploitation probability above baseline; (4) The attack requires prior authentication (PR:L), which moderately reduces attack surface compared to unauthenticated RCE, but many Tenda devices have weak default credentials or authentication bypass issues; (5) No KEV/CISA listing mentioned, but POC disclosure suggests imminent or ongoing exploitation; (6) SSVC assessment: exploitation is PoC-public, the attack is network-automatable, and technical impact is complete system compromise—this warrants immediate patching priority. The low authentication requirement is the primary mitigating factor; without it, this would be near-maximum severity. Real-world risk is HIGH for organizations deploying O3V2 routers, especially in edge network segments where credential compromise is feasible.

An attacker with access to the Tenda O3V2 management interface (e.g., via weak default credentials, phishing, or compromise of a user on the same network) sends a crafted HTTP POST request to http://<router-ip>/goform/setRateTest with a maliciously oversized destIP parameter containing shellcode. The httpd daemon's fromSpeedTestSet function copies this input to a stack buffer without bounds checking, overwriting the return address. When the function returns, control flow redirects to the attacker's shellcode, granting remote code execution as root. The attacker can then pivot to exfiltrate network traffic, compromise IoT devices, inject malware, or launch further lateral movement attacks. No user interaction or additional complexity is required once authenticated access is obtained. Given public POC availability, an attacker can automate credential guessing or reuse known Tenda default credentials to rapidly compromise multiple devices at scale.