CVE-2025-25676

Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDset function

Critical · published February 20, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

🔥 A crafty buffer overflow in Tenda i12 could let attackers overflow their way right into your device’s memory! Think of it as a waiter trying to serve a dish that’s too big for the table — if the order isn’t properly checked, it can spill everywhere, causing chaos in the restaurant! An attacker could exploit this vulnerability to execute arbitrary code, potentially taking full control of your device. This could lead to unauthorized access, data loss, or even turning your router into a puppet for malicious activities. Absolutely devastating! 😱

Put simply

Think of it as a waiter trying to serve a dish that’s too big for the table — if the order isn’t properly checked, it can spill everywhere, causing chaos in the restaurant! This vulnerability arises from a buffer overflow in the list parameter of the formwrlSSIDset function, allowing attackers to overwrite memory and execute harmful code.

What to do

An attacker could exploit this vulnerability to execute arbitrary code, potentially taking full control of your device. This could lead to unauthorized access, data loss, or even turning your router into a puppet for malicious activities. Absolutely devastating! 😱 Update your Tenda i12 to version 1.0.0.11 or later immediately. Additionally, consider implementing strict input validation to prevent such overflow issues in the future. Don’t leave your network exposed! You’ve got this! With a simple update, you can protect your network from this critical flaw. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00450 · 38.1th percentile
Published
2025-02-20T00:00Z
EPSS history
Timeline
  • 20 FEB 00:00Z
    Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDset function
    cvelistv5