PT-2025-34212 · Tenda · Tenda M3

Davybat · Published 2025-08-21 · Updated 2025-08-26 · CVE-2025-9299

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Tenda M3 version 1.0.0.12

Description: A vulnerability has been identified in the Tenda M3 device. The formGetMasterPassengerAnalyseData function within the /goform/getMasterPassengerAnalyseData file is susceptible to a stack-based buffer overflow. This occurs through the manipulation of the Time argument. The attack can be initiated remotely.

Recommendations: Tenda M3 version 1.0.0.12: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

CVE-2025-9299

Affected Products

Tenda M3

References · 14

• 🔥 https://github.com/davybat/IoT-Vuls/blob/main/tenda/formGetMasterPassengerAnalyseData.md#poc · Exploit
• 🔥 https://github.com/davybat/IoT-Vuls/blob/main/tenda/formGetMasterPassengerAnalyseData.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9299 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9299 · Vendor Advisory
• https://vuldb.com/?submit.632336 · Note
• https://vuldb.com/?ctiid.320904 · Note
• https://twitter.com/CveFindCom/status/1958517032221048862 · Twitter Post
• https://t.me/CVEtracker/30579 · Telegram Post
• https://twitter.com/cracbot/status/1960296226542219556 · Twitter Post
• https://tenda.com.cn · Note
• https://vuldb.com/?id.320904 · Note
• https://twitter.com/CVEnew/status/1958516422616698888 · Twitter Post
• https://t.me/cveNotify/132992 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1958522250820215083 · Twitter Post