Log in Start free

Vulnerability · Published Jul 10, 2025 · Assigned by VulDB

CVE-2025-7415Tenda O3V2 httpd getTraceroute fromTraceroutGet command injection

Medium 6.3

In plain English

A medium-severity command injection in O3V2 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)3.4%top 11.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as critical, has been found in Tenda O3V2 1.0.0.12(3880). This issue affects the function fromTraceroutGet of the file /goform/getTraceroute of the component httpd. The manipulation of the argument dest leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

VendorProductVersions
Tenda O3V2 1.0.0.12(3880)

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References