Tenda o3 FIRMWARE1.0.0.10(2478) vulnerabilities

10 CVEs affecting Tenda o3 FIRMWARE1.0.0.10(2478), 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-12214, published 2025-10-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-6963, published 2024-07-22. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, has been found in Tenda O3 1.0.0.10. This issue affects the function formexeCommand. The manipulation of the argument cmdinput leads to stack-based…
CVE-2024-6965, published 2024-07-22. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability has been found in Tenda O3 1.0.0.10 and classified as critical. Affected by this vulnerability is the function fromVirtualSet. The manipulation of the argument…
CVE-2024-6964, published 2024-07-22. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, was found in Tenda O3 1.0.0.10. Affected is the function fromDhcpSetSer. The manipulation of the argument…
CVE-2024-6962, published 2024-07-22. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in Tenda O3 1.0.0.10. This vulnerability affects the function formQosSet. The manipulation of the argument remark/ipRange/upSpeed/downSpeed/enable…
CVE-2025-12210, published 2025-10-27. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability was identified in Tenda O3 1.0.0.10(2478). Affected by this vulnerability is the function SetValue/GetValue of the file /goform/AdvSetLanip. The manipulation of the argument lanIp…
CVE-2025-12209, published 2025-10-27. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability was determined in Tenda O3 1.0.0.10(2478). Affected is the function SetValue/GetValue of the file /goform/setDhcpConfig. Executing a manipulation of the argument dhcpEn can lead to…
CVE-2025-12211, published 2025-10-27. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. A security flaw has been discovered in Tenda O3 1.0.0.10(2478). Affected by this issue is the function SetValue/GetValue of the file /goform/setDmzInfo. The manipulation of the argument dmzIP results…
CVE-2025-12214, published 2025-10-27. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability was detected in Tenda O3 1.0.0.10(2478). This issue affects the function SetValue/GetValue of the file /goform/sysAutoReboot. Performing a manipulation of the argument enable results…
CVE-2025-12213, published 2025-10-27. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A security vulnerability has been detected in Tenda O3 1.0.0.10(2478). This vulnerability affects the function SetValue/GetValue of the file /goform/setVlanConfig. Such manipulation of the argument…
CVE-2025-12212, published 2025-10-27. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A weakness has been identified in Tenda O3 1.0.0.10(2478). This affects the function SetValue/GetValue of the file /goform/setNetworkService. This manipulation of the argument upnpEn causes…