CVE-2025-12213
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
A stack-based buffer overflow vulnerability was detected in Tenda O3 in the SetValue/GetValue function of /goform/setVlanConfig, caused by manipulation of the lan argument. The attack can be launched remotely, and the exploit has been publicly disclosed.
Risk Assessment
A remote attack could lead to buffer overflow, potentially allowing arbitrary code execution or causing device crash, threatening network security.
Recommendation
Update the Tenda O3 firmware and restrict access to the administrative interface.
Other vulnerabilities in Tenda O3
See all- CVE-2026-36784High
The Tenda O3 Wireless Router v1.0.0.5(4180) contains a stack overflow in the ip parameter of the fromNetToolGet function. An attacker can exploit this vulnerability by sending an HTTP request, leading to a Denial of Service (DoS).
- CVE-2026-36783High
Tenda O3 Wireless Router v1.0.0.5(4180) has a stack overflow in the domain parameter of the fromNetToolGet function. This allows an attacker to cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36779High
Tenda O3 Wireless Router v1.0.0.5(4180) has multiple stack overflows in the fromVirtualSer function via parameters puVar2, puVar1, __s2, __s1_00, and puVar3. This allows an attacker to cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36778Medium
Tenda O3 router firmware v1.0.0.5(4180) has a stack overflow in the username parameter of the R7WebsSecurityHandler function. This allows an attacker to cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2025-12210High
A vulnerability was identified in Tenda O3 1.0.0.10(2478). Affected by this vulnerability is the function SetValue/GetValue of the file /goform/AdvSetLanip. The manipulation of the argument lanIp leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
Original NVD description (English source)
A security vulnerability has been detected in Tenda O3 1.0.0.10(2478). This vulnerability affects the function SetValue/GetValue of the file /goform/setVlanConfig. Such manipulation of the argument lan leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS