CVE-2025-3820
Published: 19 April 2025
Summary
CVE-2025-3820 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda W12 Firmware. Its CVSS base score is 8.7 (High).
Operationally, ranked in the top 10.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A stack-based buffer overflow vulnerability exists in Tenda W12 and i24 firmware versions 3.0.0.4(2887) and 3.0.0.5(3644). The flaw resides in the cgiSysUplinkCheckSet function within the /bin/httpd binary and is triggered by unsanitized input to the hostIp1 and hostIp2 parameters. It is tracked as CVE-2025-3820, carries a CVSS 4.0 score of 8.7, and is also associated with CWE-119 and CWE-121.
An authenticated remote attacker can supply crafted values to the affected parameters and trigger the overflow, resulting in arbitrary code execution or a denial of service on the device. Public exploit code has already been released, enabling any party with network access and valid credentials to attempt exploitation.
The EPSS score remains flat at 0.0492 with no material increase since disclosure. No vendor advisory or patch information is provided in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-11945
Vulnerability details
A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644) and classified as critical. Affected by this issue is the function cgiSysUplinkCheckSet of the file /bin/httpd. The manipulation of the argument hostIp1/hostIp2 leads to stack-based buffer overflow. The attack may…
more
be launched remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Ongoing control assessments and code testing (static/dynamic analysis, fuzzing) surface memory buffer restriction failures, which are then remediated before release.
Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.
Memory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.
Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.