CVE-2025-7417
Published: 10 July 2025
Summary
CVE-2025-7417 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda O3 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates the 'ip' argument in the /goform/setPingInfo endpoint to prevent stack-based buffer overflow exploitation.
Implements memory protections such as stack canaries and address space layout randomization to mitigate stack-based buffer overflow exploits.
Requires identification, reporting, and correction of the specific buffer overflow flaw in Tenda O3V2 firmware version 1.0.0.12(3880).
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the remotely accessible httpd web interface (/goform/setPingInfo) of Tenda O3V2 router enables exploitation of a public-facing application, with public PoC available.
NVD Description
A vulnerability has been found in Tenda O3V2 1.0.0.12(3880) and classified as critical. Affected by this vulnerability is the function fromNetToolGet of the file /goform/setPingInfo of the component httpd. The manipulation of the argument ip leads to stack-based buffer overflow.…
more
The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-7417 is a critical stack-based buffer overflow vulnerability in Tenda O3V2 firmware version 1.0.0.12(3880). The flaw affects the fromNetToolGet function within the /goform/setPingInfo endpoint of the httpd component, where manipulation of the 'ip' argument triggers the overflow.
The vulnerability enables remote exploitation by attackers with low privileges (PR:L), requiring no user interaction (UI:N) and low attack complexity (AC:L). Successful exploitation grants high impacts across confidentiality, integrity, and availability (C:H/I:H/A:H), as reflected in its CVSS v3.1 base score of 8.8, potentially leading to full compromise of the affected device.
Advisories documented on VulDB (ctiid.315877, id.315877) and GitHub repositories detail the issue, including a publicly disclosed proof-of-concept exploit. The exploit availability increases the risk of active misuse.
Details
- CWE(s)