CVE-2025-7414
Published: 10 July 2025
Summary
CVE-2025-7414 is a medium-severity Command Injection (CWE-77) vulnerability in Tenda O3 Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates OS command injection by requiring validation and sanitization of the untrusted domain argument in the fromNetToolGet function.
Addresses the specific flaw in Tenda O3V2 firmware version 1.0.0.12(3880) through timely identification, reporting, and remediation such as patching.
Reduces impact of command injection exploits by enforcing least privilege on low-privilege authenticated sessions accessing the vulnerable httpd endpoint.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection via unauthenticated remote web request on router httpd enables initial access through public-facing app exploitation (T1190), indirect command execution likely via ping utility (T1202), and Unix shell command execution (T1059.004).
NVD Description
A vulnerability classified as critical was found in Tenda O3V2 1.0.0.12(3880). This vulnerability affects the function fromNetToolGet of the file /goform/setPingInfo of the component httpd. The manipulation of the argument domain leads to os command injection. The attack can be…
more
initiated remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-7414 is a critical vulnerability in Tenda O3V2 firmware version 1.0.0.12(3880). It affects the fromNetToolGet function within the /goform/setPingInfo file of the httpd component, where manipulation of the domain argument enables OS command injection. The issue maps to CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
The vulnerability is remotely exploitable over the network with low attack complexity and requires low privileges (PR:L), with no user interaction needed and unchanged impact scope. It carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), allowing attackers to achieve low confidentiality, integrity, and availability impacts. Through OS command injection, adversaries with authenticated low-privilege access can execute arbitrary operating system commands on the device.
Advisories and references, including GitHub disclosures with proof-of-concept code and VulDB entries, confirm the exploit has been publicly released and may be actively used. No vendor patches or specific mitigation steps are detailed in the provided information.
Details
- CWE(s)