High · published October 27, 2025
🚨 A sneaky stack-based buffer overflow lurks in Tenda O3 version 1.0.0.10(2478), and it can be triggered remotely! ⚡ Think of it like a restaurant with a very flexible menu where a mischievous customer can order way more than intended, overflowing the kitchen with unmanageable orders. This vulnerability allows an attacker to exploit the SetValue/GetValue function to overflow the stack, much like piling too many dishes on a single table until it collapses! If successfully exploited, an attacker could gain control over the affected device, potentially executing arbitrary code or even crashing it entirely. This could lead to a complete service disruption and compromise sensitive information, making it a significant risk for users of Tenda O3 routers.
Think of it like a restaurant with a very flexible menu where a mischievous customer can order way more than intended, overflowing the kitchen with unmanageable orders. This vulnerability allows an attacker to exploit the SetValue/GetValue function to overflow the stack, much like piling too many dishes on a single table until it collapses! The vulnerability arises in the /goform/setVlanConfig file, where manipulation of the 'lan' argument leads to a stack-based buffer overflow. This allows attackers to execute malicious code remotely without any authentication.
If successfully exploited, an attacker could gain control over the affected device, potentially executing arbitrary code or even crashing it entirely. This could lead to a complete service disruption and compromise sensitive information, making it a significant risk for users of Tenda O3 routers. Immediately patch your device to the latest version to close this vulnerability. If a patch isn’t available yet, consider disabling remote management features as a temporary measure. Regularly check for firmware updates to stay secure! You've got this! Follow these steps, and you'll be protecting your network like a pro! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| tenda/o3_firmware1.0.0.10\(2478\) | all versions | — |