Vulnerability · Published Jul 10, 2025 · Assigned by VulDB
CVE-2025-7414Tenda O3V2 httpd setPingInfo fromNetToolGet os command injection
Medium 6.3
In plain English
A medium-severity OS command injection in O3V2 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 12.6% (higher than 96% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)12.6%top 3.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability classified as critical was found in Tenda O3V2 1.0.0.12(3880). This vulnerability affects the function fromNetToolGet of the file /goform/setPingInfo of the component httpd. The manipulation of the argument domain leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected products (as reported)
Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-315874 | Tenda O3V2 httpd setPingInfo fromNetToolGet os command injection vdb-entry, technical-description
- VDB-315874 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #608855 | Tenda O3V2 1.0.0.12(3880) OS Command Injection third-party-advisory
- https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_47/47.md related
- https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_47/47.md#poc exploit
- https://www.tenda.com.cn/ product