CVE-2025-7415: fallo de gravedad media en Tenda O3V2
Tenda O3V2 httpd getTraceroute fromTraceroutGet command injection
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 3.4%
A vulnerability, which was classified as critical, has been found in Tenda O3V2 1.0.0.12(3880). This issue affects the function fromTraceroutGet of the file /goform/getTraceroute of the component httpd. The manipulation of the argument dest leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
Tenda · O3V2CVEs relacionadas — Tenda O3V2
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-7414MEDIUMTenda O3V2 httpd setPingInfo fromNetToolGet os command injectionEPSS 12.6%CVE-2025-7423HIGHTenda O3V2 httpd setWrlFilterList formWifiMacFilterSet stack-based overflowEPSS 1.0%CVE-2025-7422HIGHTenda O3V2 httpd setNetworkService setAutoReboot stack-based overflowEPSS 1.0%CVE-2025-7421HIGHTenda O3V2 httpd operateMacFilter fromMacFilterModify stack-based overflowEPSS 1.0%CVE-2025-7420HIGHTenda O3V2 httpd setWrlBasicInfo formWifiBasicSet stack-based overflowEPSS 1.0%CVE-2025-7419HIGHTenda O3V2 httpd setRateTest fromSpeedTestSet stack-based overflowEPSS 1.0%