W12 Firmware
Monthly
Denial-of-service in Tenda W12 router firmware 3.0.0.6(3948) via a null pointer dereference in the `wifiScheduledSet` HTTP request handler. A remote attacker with low-privilege credentials can trigger the flaw to disrupt router availability. Public exploit code exists, but active exploitation has not been confirmed (CISA KEV absent) and the EPSS score (0.09%) suggests a low probability of widespread exploitation.
Stack-based buffer overflow in Tenda W12 firmware version 3.0.0.6(3948) allows an authenticated remote attacker to crash or potentially execute code on the device by sending an overlong 'mac' argument to the wifiMacFilterSet function exposed through the /goform/modules HTTP endpoint. Exploitation requires valid low-privilege credentials or a session on the router's web management interface (CVSS PR:L), which in practice means LAN-side access unless remote management is exposed to the WAN; no user interaction is needed and attack complexity is low. Publicly available exploit code exists (a GitHub PoC with a binary-audit write-up), EPSS is 8.48% (95th percentile) indicating elevated real-world attention, but there is no KEV entry confirming active exploitation, and the flaw is confined to this single firmware build.
A vulnerability classified as critical was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644). Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644) and classified as critical. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644). Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644). Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Tenda W12 3.0.0.5. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Denial-of-service in Tenda W12 router firmware 3.0.0.6(3948) via a null pointer dereference in the `wifiScheduledSet` HTTP request handler. A remote attacker with low-privilege credentials can trigger the flaw to disrupt router availability. Public exploit code exists, but active exploitation has not been confirmed (CISA KEV absent) and the EPSS score (0.09%) suggests a low probability of widespread exploitation.
Stack-based buffer overflow in Tenda W12 firmware version 3.0.0.6(3948) allows an authenticated remote attacker to crash or potentially execute code on the device by sending an overlong 'mac' argument to the wifiMacFilterSet function exposed through the /goform/modules HTTP endpoint. Exploitation requires valid low-privilege credentials or a session on the router's web management interface (CVSS PR:L), which in practice means LAN-side access unless remote management is exposed to the WAN; no user interaction is needed and attack complexity is low. Publicly available exploit code exists (a GitHub PoC with a binary-audit write-up), EPSS is 8.48% (95th percentile) indicating elevated real-world attention, but there is no KEV entry confirming active exploitation, and the flaw is confined to this single firmware build.
A vulnerability classified as critical was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644). Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644) and classified as critical. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644). Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644). Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Tenda W12 3.0.0.5. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.