CVE-2025-7415
Published: 10 July 2025
Summary
CVE-2025-7415 is a medium-severity Injection (CWE-74) vulnerability in Tenda O3 Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by validating the 'dest' argument in the /goform/getTraceroute endpoint to ensure only legitimate traceroute destinations like IP addresses are accepted.
Ensures timely identification, reporting, and patching of the specific command injection flaw in the fromTraceroutGet function of the Tenda O3V2 httpd component.
Enforces restrictions on the 'dest' parameter such as length, type, and patterns to block command injection payloads at the application boundary.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in the httpd /goform/getTraceroute endpoint enables remote arbitrary command execution on the router via the 'dest' parameter, facilitating exploitation of public-facing web applications, remote services, network device CLI, and indirect command execution.
NVD Description
A vulnerability, which was classified as critical, has been found in Tenda O3V2 1.0.0.12(3880). This issue affects the function fromTraceroutGet of the file /goform/getTraceroute of the component httpd. The manipulation of the argument dest leads to command injection. The attack…
more
may be initiated remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-7415 is a command injection vulnerability classified as critical in the Tenda O3V2 firmware version 1.0.0.12(3880). It affects the fromTraceroutGet function within the /goform/getTraceroute endpoint of the httpd component. The issue arises from improper handling of the 'dest' argument, allowing attackers to inject arbitrary commands.
The vulnerability has a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and is remotely exploitable over the network with low complexity. Exploitation requires low privileges, such as an authenticated user account, and can result in limited confidentiality, integrity, and availability impacts (CWE-74, CWE-77). Attackers can manipulate the 'dest' parameter to execute commands on the device.
References include a GitHub repository detailing the vulnerability and providing a proof-of-concept exploit, as well as entries on VulDB. No specific patches or mitigation steps from vendor advisories are detailed in the available information, though the public disclosure of the exploit increases the risk of active use.
Details
- CWE(s)