CVE-2025-7414CWE-77CWE-78

Tenda O3V2 httpd setPingInfo fromNetToolGet os command injection

Medium · published July 10, 2025

CVSS v4.0

5.3

EPSS

13%

Percentile

96.2

In the wild

Unconfirmed

What it is

A vulnerability classified as critical was found in Tenda O3V2 1.0.0.12(3880). This vulnerability affects the function fromNetToolGet of the file /goform/setPingInfo of the component httpd. The manipulation of the argument domain leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

The record

Technical detail

CVSS v4.0: 5.3 · MEDIUM
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS: 0.12620 · 96.2th percentile
Weaknesses: CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2025-07-10T20:32Z

EPSS history

Timeline

10 JUL 20:32Z
Tenda O3V2 httpd setPingInfo fromNetToolGet os command injection
cvelistv5