CVE-2025-12209: Tenda o3 FIRMWARE1.0.0.10(2478)

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

A vulnerability was determined in Tenda O3 1.0.0.10(2478). Affected is the function SetValue/GetValue of the file /goform/setDhcpConfig. Executing a manipulation of the argument dhcpEn can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

Affected products

• Tenda o3 FIRMWARE1.0.0.10(2478): any version

Published 2025-10-27. Last modified 2026-10-08.