CVE-2025-11550CWE-404CWE-476

CVE-2025-11550

Medium · published October 9, 2025

CVSS v3.1
6.5
EPSS
1%
Percentile
61.0
In the wild
Unconfirmed
What it is

A vulnerability was found in Tenda W12 3.0.0.6(3948). The impacted element is the function wifiScheduledSet of the file /goform/modules of the component HTTP Request Handler. The manipulation of the argument wifiScheduledSet results in null pointer dereference. The attack may be performed from remote. The exploit has been made public and could be used.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00956 · 61.0th percentile
Weaknesses
CWE-404 · Improper Resource Shutdown or Release; CWE-476 · NULL Pointer Dereference
Published
2025-10-09T22:15Z
Affected products (1)
ProductVersionsFixed in
tenda/w12_firmwareall versions—
References (6)
https://github.com/z472421519/BinaryAudit/blob/main/PoC/NPD/Tenda_W12/cgiWifiScheduledSet/cgiWifiScheduledSet.md · [email protected]https://vuldb.com/?ctiid.327709 · [email protected]https://vuldb.com/?id.327709 · [email protected]https://vuldb.com/?submit.670118 · [email protected]https://www.tenda.com.cn/ · [email protected]https://github.com/z472421519/BinaryAudit/blob/main/PoC/NPD/Tenda_W12/cgiWifiScheduledSet/cgiWifiScheduledSet.md · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 09 OCT 18:02Z
    Tenda W12 HTTP Request modules wifiScheduledSet null pointer dereference
    cvelistv5