O3 Firmware EUVD-2025-21097

This vulnerability presents HIGH real-world risk despite requiring authentication (PR:L in CVSS vector). Risk signals indicate: (1) CVSS 8.8 reflects high severity with network accessibility, low attack complexity, and complete system compromise potential; (2) Public POC disclosure significantly elevates exploitation probability and enables script-kiddie attacks; (3) Tenda devices are consumer-grade routers with millions deployed globally, creating massive exposure; (4) Stack-based buffer overflows are reliably exploitable and often bypass modern mitigations in embedded firmware; (5) Authentication requirement (PR:L) is mitigated by weak default credentials common in Tenda devices and typical home network accessibility patterns where attackers gain initial access via other means. The combination of public exploitability, wide device deployment, reliable exploitation technique, and disclosed attack surface makes this a priority for immediate patching. The primary limiting factor is the authentication requirement, but this should not be overweighted given typical device security postures.

An attacker with network access to the router (either on local LAN or if remote management is enabled) authenticates with default or weak credentials to the Tenda O3V2 device. The attacker crafts an HTTP POST request to /goform/setWrlFilterList with a specially crafted macList parameter containing a payload longer than the destination stack buffer (likely 32-256 bytes based on typical MAC filter implementations). The oversized input overflows the stack buffer, overwriting a return address with attacker-controlled data. Upon function return, execution flows to the attacker's shellcode (typically placed in the payload itself or in a predictable memory location). The attacker achieves code execution with the privileges of the httpd process (likely root on embedded systems), enabling them to capture traffic, modify firewall rules, perform man-in-the-middle attacks, establish persistence, or pivot to other network devices. No special user interaction is required; the attack is fully automated. With public POC code available, this attack can be executed by script-based worms or botnets.