PT-2025-29165 · Tenda · Tenda O3V2

Pjq123 · Published 2025-07-04 · Updated 2025-10-10 · CVE-2025-7414

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda O3V2 version 1.0.0.12(3880)

Description A critical issue exists in Tenda O3V2 version 1.0.0.12(3880). The fromNetToolGet function within the /goform/setPingInfo file of the httpd component is susceptible to operating system command injection. Manipulation of the domain argument allows for remote execution of commands. The exploit has been publicly disclosed and may be actively exploited.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /goform/setPingInfo file. Disable the fromNetToolGet function if possible.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2025-08758

CVE-2025-7414

Affected Products

Tenda O3V2

References · 12

• 🔥 https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_47/47.md · Exploit
• 🔥❌ https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_47/47.md#poc · Exploit, Deleted
• https://bdu.fstec.ru/vul/2025-08758 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7414 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7414 · Security Note
• https://vuldb.com/?submit.608855 · Note
• https://t.me/true_secator/7514 · Telegram Post
• https://tenda.com.cn · Note
• https://vuldb.com/?id.315874 · Note
• https://trendmicro.com/en_us/research/25/j/rondodox.html · Note
• https://vuldb.com/?ctiid.315874 · Note
• https://twitter.com/CVEnew/status/1943668184558739485 · Twitter Post