CVE-2025-11550

A vulnerability has been found in Tenda W12 3.0.0.6(3948) in the wifiMacFilterSet function of the /goform/modules file in the HTTP Request Handler component. Manipulation of the mac argument leads to a stack-based buffer overflow. The attack can be carried out remotely, and the exploit has been publicly disclosed.

In Tenda W12 version 3.0.0.7(4763), a stack-based buffer overflow exists in the set_local_time_0 function in /bin/httpd when manipulating the Time argument. Remote exploitation is possible. The exploit is public.

In Tenda W12 version 3.0.0.7(4763), a vulnerability exists in the cgiWifiMacFilterSet function of the /bin/httpd file. Manipulation of the wifiMacFilterSet.macList.mac argument leads to a stack-based buffer overflow, which can be exploited remotely. The exploit has been publicly disclosed.

A vulnerability was found in Tenda W12 3.0.0.7(4763). It affects the cgiSysWebTimeoutSet function in the file /bin/httpd of the Web Management Interface component. Manipulating the web_over_time argument results in denial of service. The attack can be launched remotely. The exploit has been made public.

A stack-based buffer overflow vulnerability was found in the cgiSysTimeInfoSet function in /bin/httpd of Tenda W12 router version 3.0.0.7(4763). Remote attack is possible by manipulating the sec argument. The exploit has been publicly disclosed.

In Tenda W12 version 3.0.0.7(4763), a vulnerability exists in the cgistaKickOff function of the /bin/httpd file. Manipulation of the staMac argument leads to a stack-based buffer overflow, which can be exploited remotely. The exploit has been publicly disclosed.