Stack-based Buffer Overflow in Tenda O3V2 Router
CVE-2025-7420
Key Information:
Badges
What is CVE-2025-7420?
A vulnerability exists in the Tenda O3V2 router's HTTP daemon. The flaw is located in the function formWifiBasicSet, specifically within the /goform/setWrlBasicInfo endpoint. An attacker could exploit this weakness through the manipulation of the extChannel argument, leading to a stack-based buffer overflow. This issue allows for remote code execution, putting the device at risk of unauthorized access and potential network compromise. The vulnerability has been made public, raising concerns for users regarding the security of their devices.
Affected Version(s)
O3V2 1.0.0.12(3880)
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.