CVE-2025-12211
Published: 27 October 2025
Summary
CVE-2025-12211 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda O3 Firmware1.0.0.10\(2478\). Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 38.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-12211 is a stack-based buffer overflow vulnerability in the Tenda O3 router running firmware version 1.0.0.10(2478). The flaw affects the SetValue and GetValue functions within the /goform/setDmzInfo endpoint, triggered by manipulating the dmzIP argument. Associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), it has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation.
Attackers with low privileges (PR:L), such as authenticated users on the network, can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation of the buffer overflow could result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution, data compromise, or device takeover.
Advisories from VulDB (ctiid.329881, id.329881, submit.673265) document the issue and note that a public exploit is available on GitHub at noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/setDmzInfo.md, increasing the risk of active attacks. The vendor's site at tenda.com.cn should be checked for firmware updates or patches, though no specific mitigation details are outlined in the provided references.
The exploit's public release heightens the urgency for Tenda O3 users to assess exposure and apply any available updates, as it may already be leveraged in targeted IoT attacks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-36074
Vulnerability details
A security flaw has been discovered in Tenda O3 1.0.0.10(2478). Affected by this issue is the function SetValue/GetValue of the file /goform/setDmzInfo. The manipulation of the argument dmzIP results in stack-based buffer overflow. It is possible to launch the attack…
more
remotely. The exploit has been released to the public and may be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the public-facing web endpoint /goform/setDmzInfo allows remote code execution via unauthenticated exploitation of the router's application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents the stack-based buffer overflow by validating the dmzIP argument in the /goform/setDmzInfo endpoint to ensure it stays within memory bounds.
Implements memory safeguards like stack canaries or DEP to protect against exploitation of the stack-based buffer overflow even if input validation fails.
Requires timely remediation of the identified buffer overflow flaw through firmware updates or patches from the vendor.