Exploitation Summary
CVE-2025-7414 has been observed exploited in the wild (reported by VulnCheck KEV).
Description
A vulnerability classified as critical was found in Tenda O3V2 1.0.0.12(3880). This vulnerability affects the function fromNetToolGet of the file /goform/setPingInfo of the component httpd. The manipulation of the argument domain leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
References (6)
Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry
technical-description
https://vuldb.com/?id.315874
Permissions Required, VDB Entry signature
permissions-required
https://vuldb.com/?ctiid.315874
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.608855
Exploit, Third Party Advisory related
https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_47/47.md
Exploit, Third Party Advisory exploit
https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_47/47.md#poc
Product product
https://www.tenda.com.cn/
Scores
CVSS v3
6.3
EPSS
0.1273
EPSS Percentile
95.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
VulnCheck KEV
2025-09-23
CWE
CWE-77
CWE-78
Status
published
Products (1)
tenda/o3_firmware
1.0.0.12\(3880\)
Published
Jul 10, 2025
Tracked Since
Feb 18, 2026