Vulnerability · Published Apr 19, 2025 · Assigned by VulDB
CVE-2025-3802Tenda W12/i24 httpd cgiPingSet stack-based overflow
High 8.8
In plain English
A high-severity stack buffer overflow in i24 from Tenda. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.1%top 34.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644). It has been declared as critical. This vulnerability affects the function cgiPingSet of the file /bin/httpd. The manipulation of the argument pingIP leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected products (as reported)
Weakness: CWE-121, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- VDB-305656 | Tenda W12/i24 httpd cgiPingSet stack-based overflow vdb-entry, technical-description
- VDB-305656 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #554746 | Tenda w12 and i24 w12 V3.0.0.5(3644) and i24 V3.0.0.4(2887) Stack-based Buffer Overflow third-party-advisory
- https://github.com/02Tn/vul/issues/2 exploit, issue-tracking
- https://www.tenda.com.cn/ product