CVE-2025-7422
Published: 11 July 2025
Summary
CVE-2025-7422 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda O3 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
A critical stack-based buffer overflow vulnerability, tracked as CVE-2025-7422, affects the Tenda O3V2 wireless device running firmware version 1.0.0.12(3880). The flaw resides in the setAutoReboot function within the /goform/setNetworkService endpoint of the httpd component and is triggered by unsanitized input to the week argument, corresponding to CWE-119 and CWE-121.
An authenticated remote attacker can supply a crafted week parameter to overflow the stack buffer, leading to arbitrary code execution or a denial-of-service condition on the device. The attack requires no user interaction and can be launched over the network with low attack complexity, as confirmed by the CVSS 7.4 vector.
Public proof-of-concept code has been released on GitHub, and the vulnerability is catalogued in VulDB with submission details, indicating that exploitation artifacts are already available to potential adversaries. The associated EPSS score remains flat at 0.0157 with no material increase since disclosure. No vendor advisory or patch information is referenced in the available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21098
Vulnerability details
A vulnerability classified as critical has been found in Tenda O3V2 1.0.0.12(3880). Affected is the function setAutoReboot of the file /goform/setNetworkService of the component httpd. The manipulation of the argument week leads to stack-based buffer overflow. It is possible to…
more
launch the attack remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the httpd web component (/goform/setNetworkService) of the Tenda O3V2 router enables remote exploitation of a public-facing application for potential code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates the 'week' argument input to the setAutoReboot function, preventing the stack-based buffer overflow triggered by malformed data.
Implements memory protections like stack canaries and non-executable stacks to mitigate exploitation of the stack-based buffer overflow even if input validation fails.
Ensures timely patching of the vulnerable firmware version 1.0.0.12(3880) to remediate the buffer overflow in the httpd component.