O3 Firmware1 0 0 10 2478
Monthly
Authenticated remote attackers can trigger a stack-based buffer overflow in Tenda O3 firmware 1.0.0.10(2478) by manipulating the 'enable' parameter of the /goform/sysAutoReboot endpoint. Exploitation requires valid low-privilege web credentials (PR:L), but no user interaction, and publicly available exploit code exists. The EPSS score is low (0.8%), suggesting limited real-world exploitation, but the impact is high (full confidentiality, integrity, and availability loss on the device if exploited).
Stack-based buffer overflow in Tenda O3 firmware 1.0.0.10(2478) allows a remote attacker with low-level authenticated access to the device management interface to corrupt memory via an overlong 'lan' parameter submitted to the /goform/setVlanConfig endpoint, potentially achieving arbitrary code execution or a denial of service. The issue is confined to a single legacy firmware build of this outdoor bridge/CPE device, and exploitation requires the web management service to be network-reachable plus valid low-privilege credentials (CVSS 4.0 PR:L; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Publicly available exploit code exists (a detailed PoC write-up is published on GitHub), but there is no confirmed actively exploited (CISA KEV) status, and EPSS is low at 0.80% (55th percentile), so real-world risk is moderate and concentrated in deployments where the admin interface is exposed.
Stack-based buffer overflow in the SetValue/GetValue handler of the /goform/setNetworkService endpoint on Tenda O3 firmware 1.0.0.10(2478) lets an authenticated low-privilege attacker who can reach the device's web management interface overwrite stack memory by sending an oversized upnpEn argument, yielding complete loss of confidentiality, integrity, and availability on the device itself (assessed CVSS:3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Publicly available exploit code exists, including a GitHub proof-of-concept and a VULDB submission, but the issue is not listed in CISA KEV and EPSS is 0.80% (55th percentile), so active exploitation is not confirmed. Because the CVSS vector specifies PR:L, a valid low-privilege session or working credentials are needed rather than fully anonymous access, and the management interface must be network-reachable.
Stack-based buffer overflow in the Tenda O3 router firmware 1.0.0.10(2478) allows remote authenticated attackers with low-privilege web-interface credentials to corrupt memory, and potentially execute code or crash the device, by sending an overlong dmzIP parameter to the /goform/setDmzInfo endpoint. Publicly available exploit code exists (referenced GitHub PoC), though the CVE is not in CISA KEV and EPSS is 0.84% (56th percentile), indicating a real but not top-tier priority. Reachability is constrained because exploitation requires access to the router's HTTP management interface, typically LAN-side unless remote management is explicitly enabled, and authentication is required per the assessed CVSS vector (PR:L).
Stack-based buffer overflow in the Tenda O3 router firmware build 1.0.0.10(2478) lets authenticated remote attackers corrupt stack memory through a crafted lanIp value submitted to the /goform/AdvSetLanip web endpoint, potentially achieving code execution or forcing a device crash/reboot. Exploitation requires network reachability to the router's HTTP management interface and, per the CVSS PR:L metric, valid credentials; the flaw is not pre-authentication. Publicly available proof-of-concept exploit code exists (E:P in the CVSS v4.0 vector, plus a GitHub write-up), and EPSS sits at roughly 1.08% (64th percentile), indicating moderate but not elevated real-world targeting; there is no CISA KEV listing, so active exploitation is not confirmed.
Stack-based buffer overflow in the HTTP management interface of Tenda O3 firmware 1.0.0.10(2478) lets a low-privileged, authenticated remote attacker corrupt memory via a crafted dhcpEn parameter sent to /goform/setDhcpConfig, with the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) indicating high confidentiality, integrity and availability impact. The critical limiting factor is the PR:L requirement: the attacker must first reach the device's web management plane and hold valid low-privilege credentials or a session, so real-world exposure depends on whether the admin interface is reachable beyond the LAN (for example via enabled remote management or WAN-side access) and whether default or weak credentials remain in place. Publicly available exploit code exists and the EPSS score of 1.03% (63rd percentile) places it in the moderate-priority band; there is no CISA KEV confirmation of active exploitation, and no vendor-released patch has been identified at time of analysis.
A vulnerability has been found in Tenda O3 1.0.0.10 and classified as critical. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated remote attackers can trigger a stack-based buffer overflow in Tenda O3 firmware 1.0.0.10(2478) by manipulating the 'enable' parameter of the /goform/sysAutoReboot endpoint. Exploitation requires valid low-privilege web credentials (PR:L), but no user interaction, and publicly available exploit code exists. The EPSS score is low (0.8%), suggesting limited real-world exploitation, but the impact is high (full confidentiality, integrity, and availability loss on the device if exploited).
Stack-based buffer overflow in Tenda O3 firmware 1.0.0.10(2478) allows a remote attacker with low-level authenticated access to the device management interface to corrupt memory via an overlong 'lan' parameter submitted to the /goform/setVlanConfig endpoint, potentially achieving arbitrary code execution or a denial of service. The issue is confined to a single legacy firmware build of this outdoor bridge/CPE device, and exploitation requires the web management service to be network-reachable plus valid low-privilege credentials (CVSS 4.0 PR:L; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Publicly available exploit code exists (a detailed PoC write-up is published on GitHub), but there is no confirmed actively exploited (CISA KEV) status, and EPSS is low at 0.80% (55th percentile), so real-world risk is moderate and concentrated in deployments where the admin interface is exposed.
Stack-based buffer overflow in the SetValue/GetValue handler of the /goform/setNetworkService endpoint on Tenda O3 firmware 1.0.0.10(2478) lets an authenticated low-privilege attacker who can reach the device's web management interface overwrite stack memory by sending an oversized upnpEn argument, yielding complete loss of confidentiality, integrity, and availability on the device itself (assessed CVSS:3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Publicly available exploit code exists, including a GitHub proof-of-concept and a VULDB submission, but the issue is not listed in CISA KEV and EPSS is 0.80% (55th percentile), so active exploitation is not confirmed. Because the CVSS vector specifies PR:L, a valid low-privilege session or working credentials are needed rather than fully anonymous access, and the management interface must be network-reachable.
Stack-based buffer overflow in the Tenda O3 router firmware 1.0.0.10(2478) allows remote authenticated attackers with low-privilege web-interface credentials to corrupt memory, and potentially execute code or crash the device, by sending an overlong dmzIP parameter to the /goform/setDmzInfo endpoint. Publicly available exploit code exists (referenced GitHub PoC), though the CVE is not in CISA KEV and EPSS is 0.84% (56th percentile), indicating a real but not top-tier priority. Reachability is constrained because exploitation requires access to the router's HTTP management interface, typically LAN-side unless remote management is explicitly enabled, and authentication is required per the assessed CVSS vector (PR:L).
Stack-based buffer overflow in the Tenda O3 router firmware build 1.0.0.10(2478) lets authenticated remote attackers corrupt stack memory through a crafted lanIp value submitted to the /goform/AdvSetLanip web endpoint, potentially achieving code execution or forcing a device crash/reboot. Exploitation requires network reachability to the router's HTTP management interface and, per the CVSS PR:L metric, valid credentials; the flaw is not pre-authentication. Publicly available proof-of-concept exploit code exists (E:P in the CVSS v4.0 vector, plus a GitHub write-up), and EPSS sits at roughly 1.08% (64th percentile), indicating moderate but not elevated real-world targeting; there is no CISA KEV listing, so active exploitation is not confirmed.
Stack-based buffer overflow in the HTTP management interface of Tenda O3 firmware 1.0.0.10(2478) lets a low-privileged, authenticated remote attacker corrupt memory via a crafted dhcpEn parameter sent to /goform/setDhcpConfig, with the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) indicating high confidentiality, integrity and availability impact. The critical limiting factor is the PR:L requirement: the attacker must first reach the device's web management plane and hold valid low-privilege credentials or a session, so real-world exposure depends on whether the admin interface is reachable beyond the LAN (for example via enabled remote management or WAN-side access) and whether default or weak credentials remain in place. Publicly available exploit code exists and the EPSS score of 1.03% (63rd percentile) places it in the moderate-priority band; there is no CISA KEV confirmation of active exploitation, and no vendor-released patch has been identified at time of analysis.
A vulnerability has been found in Tenda O3 1.0.0.10 and classified as critical. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in Tenda O3 1.0.0.10. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.