What’s Vulnerable › Vulnerabilities

CVE-2025-7414: Tenda O3V2 httpd setPingInfo fromNetToolGet os command injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 12.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-07-10 · updated 2026-06-17
• Weakness: CWE-77

Description

A vulnerability classified as critical was found in Tenda O3V2 1.0.0.12(3880). This vulnerability affects the function fromNetToolGet of the file /goform/setPingInfo of the component httpd. The manipulation of the argument domain leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products

• Tenda O3 Firmware: 1.0.0.12(3880)

References

• https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_47/47.md
• https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_47/47.md#poc
• https://vuldb.com/?ctiid.315874
• https://vuldb.com/?id.315874
• https://vuldb.com/?submit.608855
• https://www.tenda.com.cn/
• https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_47/47.md
• https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_47/47.md#poc

Get alerted when CVE-2025-7414 or the next vulnerability affects your stack