CVE-2025-7416

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in Tenda O3V2 1.0.0.12(3880). Affected is the function fromSysToolTime of the file /goform/setSysTimeInfo of the component httpd. The manipulation of the argument Time leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-121

Affected software

Vendor	Product	Versions
Tenda	O3V2	1.0.0.12(3880)

References

https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_49/49.mdExploit, Third Party Advisory
https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_49/49.md#pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.315876Permissions Required, VDB Entry
https://vuldb.com/?id.315876Third Party Advisory, VDB Entry
https://vuldb.com/?submit.608857Third Party Advisory, VDB Entry
https://www.tenda.com.cn/Product

Timeline

Published: Jul 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-74178.8A vulnerability has been found in Tenda O3V2 1.0.0.12(3880) and classified as critical. Affected by this vulnerability is the function fromN CVE-2025-74188.8A vulnerability was found in Tenda O3V2 1.0.0.12(3880) and classified as critical. Affected by this issue is the function fromPingResultGet CVE-2025-74198.8A vulnerability was found in Tenda O3V2 1.0.0.12(3880). It has been classified as critical. This affects the function fromSpeedTestSet of th CVE-2025-74208.8A vulnerability was found in Tenda O3V2 1.0.0.12(3880). It has been declared as critical. This vulnerability affects the function formWifiBa CVE-2025-74218.8A vulnerability was found in Tenda O3V2 1.0.0.12(3880). It has been rated as critical. This issue affects the function fromMacFilterModify o CVE-2025-74228.8A vulnerability classified as critical has been found in Tenda O3V2 1.0.0.12(3880). Affected is the function setAutoReboot of the file /gofo CVE-2025-74238.8A vulnerability classified as critical was found in Tenda O3V2 1.0.0.12(3880). Affected by this vulnerability is the function formWifiMacFil CVE-2025-74247.5A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type con CVE-2025-74257.8A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT CVE-2025-74269.3Information disclosure and exposure of authentication FTP credentials over the debug port 1604 in the MINOVA TTA service. This allows unauth CVE-2025-74275.9Uncontrolled Search Path Element in Arm Development Studio before 2025 may allow an attacker to perform a DLL hijacking attack. Successful e CVE-2025-74295.4Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or