CVE-2025-7421

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Tenda O3V2 1.0.0.12(3880). It has been rated as critical. This issue affects the function fromMacFilterModify of the file /goform/operateMacFilter of the component httpd. The manipulation of the argument mac leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-121

Affected software

Vendor	Product	Versions
Tenda	O3V2	1.0.0.12(3880)

References

https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_54/54.mdExploit, Third Party Advisory
https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_54/54.md#pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.315881Permissions Required
https://vuldb.com/?id.315881Third Party Advisory, VDB Entry
https://vuldb.com/?submit.608867Third Party Advisory, VDB Entry
https://www.tenda.com.cn/Product
https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_54/54.mdExploit, Third Party Advisory

Timeline

Published: Jul 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-74228.8A vulnerability classified as critical has been found in Tenda O3V2 1.0.0.12(3880). Affected is the function setAutoReboot of the file /gofo CVE-2025-74238.8A vulnerability classified as critical was found in Tenda O3V2 1.0.0.12(3880). Affected by this vulnerability is the function formWifiMacFil CVE-2025-74247.5A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type con CVE-2025-74257.8A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT CVE-2025-74269.3Information disclosure and exposure of authentication FTP credentials over the debug port 1604 in the MINOVA TTA service. This allows unauth CVE-2025-74275.9Uncontrolled Search Path Element in Arm Development Studio before 2025 may allow an attacker to perform a DLL hijacking attack. Successful e CVE-2025-74295.4Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or CVE-2025-74305.4Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Folder Message Co CVE-2025-74314.4The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin slug setting in all versions up to, and CVE-2025-74321.0DPA countermeasures in Silicon Labs' Series 2 devices are not reseeded under certain conditions. This may allow an attacker to eventually CVE-2025-74338.8A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrar CVE-2025-74348.8A vulnerability was found in Tenda FH451 up to 1.0.0.9 and classified as critical. Affected by this issue is the function fromAddressNat of