CVE-2025-7421
Published: 11 July 2025
Summary
CVE-2025-7421 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda O3 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
A vulnerability rated critical has been identified in Tenda O3V2 firmware version 1.0.0.12(3880). It resides in the fromMacFilterModify function within the /goform/operateMacFilter endpoint of the httpd component. The flaw is triggered by improper handling of the mac argument, resulting in a stack-based buffer overflow that corresponds to CWE-119 and CWE-121.
An authenticated attacker with network access can supply a crafted mac value in a remote request to the affected endpoint. Successful exploitation grants the ability to overwrite stack memory, potentially leading to arbitrary code execution or a crash of the web server process with high impact on confidentiality, integrity, and availability.
Public proof-of-concept code has been released via GitHub, confirming that the issue is reproducible. The EPSS score has remained flat at 0.0157 with no material increase since disclosure, indicating limited observed exploitation interest to date. No vendor advisory or patch information is referenced in the available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21090
Vulnerability details
A vulnerability was found in Tenda O3V2 1.0.0.12(3880). It has been rated as critical. This issue affects the function fromMacFilterModify of the file /goform/operateMacFilter of the component httpd. The manipulation of the argument mac leads to stack-based buffer overflow. The…
more
attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The stack-based buffer overflow in the httpd web component (/goform/operateMacFilter) of the public-facing Tenda O3V2 router enables remote exploitation for potential code execution, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of the 'mac' argument in the fromMacFilterModify function to prevent stack-based buffer overflows from malformed inputs.
Implements memory protections such as stack canaries and non-executable stacks to mitigate exploitation of the stack-based buffer overflow in the httpd component.
Directly addresses remediation of the identified buffer overflow flaw in Tenda O3V2 firmware version 1.0.0.12(3880) through patching or updates.