PT-2025-43873 · Tenda · Tenda O3

Yhryhryhr · Published 2025-10-11 · Updated 2025-10-28 · CVE-2025-12213

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda O3 version 1.0.0.10(2478)

Description A security issue exists in Tenda O3 version 1.0.0.10(2478). The SetValue/GetValue function within the /goform/setVlanConfig file is susceptible to a stack-based buffer overflow. This occurs through manipulation of the lan argument. The attack can be initiated remotely. The exploit for this issue has been publicly disclosed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

BDU:2025-13527

CVE-2025-12213

Affected Products

Tenda O3

References · 13

• 🔥 https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/setVlanConfig.md · Exploit
• https://bdu.fstec.ru/vul/2025-13527 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-12213 · Security Note
• https://vuldb.com/?ctiid.329883 · Note
• https://t.me/cveNotify/140381 · Telegram Post
• https://twitter.com/CveTodo/status/1983082612613677449 · Twitter Post
• https://twitter.com/CVEnew/status/1982665162143281451 · Twitter Post
• https://t.me/cveNotify/140600 · Telegram Post
• https://vuldb.com/?submit.673268 · Note
• https://twitter.com/CveFindCom/status/1982668544044150964 · Twitter Post
• https://t.me/CVEtracker/35786 · Telegram Post
• https://tenda.com.cn · Note
• https://vuldb.com/?id.329883 · Note