CVE-2025-11550: fallo de gravedad alta en Tenda W12
Tenda W12 HTTP Request modules wifiScheduledSet null pointer dereference
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 1.0%
A vulnerability was found in Tenda W12 3.0.0.6(3948). The impacted element is the function wifiScheduledSet of the file /goform/modules of the component HTTP Request Handler. The manipulation of the argument wifiScheduledSet results in null pointer dereference. The attack may be performed from remote. The exploit has been made public and could be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Productos afectados
Tenda · W12CVEs relacionadas — Tenda W12
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-3820HIGHTenda W12/i24 httpd cgiSysUplinkCheckSet stack-based overflowEPSS 12.7%CVE-2025-11549HIGHTenda W12 HTTP Request modules wifiMacFilterSet stack-based overflowEPSS 8.9%CVE-2025-3693HIGHTenda W12 httpd cgiWifiRadioSet stack-based overflowEPSS 7.4%CVE-2025-3802HIGHTenda W12/i24 httpd cgiPingSet stack-based overflowEPSS 1.1%CVE-2025-4007HIGHTenda W12/i24 httpd modules cgidhcpsCfgSet stack-based overflowEPSS 1.0%CVE-2025-3803HIGHTenda W12/i24 httpd cgiSysScheduleRebootSet stack-based overflowEPSS 1.0%