CVE-2025-11550

Name of the Vulnerable Software and Affected Versions Tenda W12 version 3.0.0.6(3948)

Description A flaw exists in the Tenda W12 device that allows for a null pointer dereference. This issue is located within the wifiScheduledSet function of the HTTP Request Handler component, specifically in the /goform/modules file. Manipulation of the wifiScheduledSet argument can trigger the issue, and the attack can be performed remotely. The exploit for this issue has been publicly released.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the /goform/modules file.