PT-2025-43869

CVE-2025-12209

Published

2025-10-12

Updated

2025-10-28

Description by

CVSS 2.0

9.0

High

MetricsAV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda O3 version 1.0.0.10(2478)

Description A flaw exists in the SetValue/GetValue function within the /goform/setDhcpConfig file of the Tenda O3 router. Manipulation of the dhcpEn argument can trigger a stack-based buffer overflow, potentially allowing for remote attacks. The exploit for this issue has been publicly disclosed.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-121: Stack-based Buffer Overflow

Related identifiers