CVE-2025-7414
Published: 10 July 2025
Summary
CVE-2025-7414 is a low-severity Command Injection (CWE-77) vulnerability in Tenda O3 Firmware. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A critical vulnerability exists in Tenda O3V2 firmware version 1.0.0.12(3880) within the httpd component. Specifically, the fromNetToolGet function in /goform/setPingInfo accepts unsanitized input to the domain argument, resulting in operating system command injection as classified under CWE-77 and CWE-78.
An authenticated remote attacker can supply crafted domain values to the affected endpoint and execute arbitrary commands on the device. The attack requires low complexity and no user interaction, with the exploit already published publicly and assigned an EPSS score of 0.0574 that has remained flat since disclosure.
Public references consist of detailed technical write-ups and proof-of-concept code hosted on GitHub along with corresponding Vuldb entries, but no vendor advisory or patch information is referenced in the available sources. The published exploit and consistent EPSS value indicate ongoing research interest without evidence of widespread in-the-wild activity.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21061
Vulnerability details
A vulnerability classified as critical was found in Tenda O3V2 1.0.0.12(3880). This vulnerability affects the function fromNetToolGet of the file /goform/setPingInfo of the component httpd. The manipulation of the argument domain leads to os command injection. The attack can be…
more
initiated remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection via unauthenticated remote web request on router httpd enables initial access through public-facing app exploitation (T1190), indirect command execution likely via ping utility (T1202), and Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates OS command injection by requiring validation and sanitization of the untrusted domain argument in the fromNetToolGet function.
Addresses the specific flaw in Tenda O3V2 firmware version 1.0.0.12(3880) through timely identification, reporting, and remediation such as patching.
Reduces impact of command injection exploits by enforcing least privilege on low-privilege authenticated sessions accessing the vulnerable httpd endpoint.