CVE-2025-11550
📋 TL;DR
A null pointer dereference vulnerability in Tenda W12 routers allows remote attackers to cause denial of service by sending specially crafted HTTP requests to the wifiScheduledSet function. This affects Tenda W12 router users running vulnerable firmware versions. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- Tenda W12
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router crash requiring physical power cycle, disrupting all network connectivity for connected devices.
Likely Case
Router becomes unresponsive or reboots, causing temporary network outage until automatic recovery.
If Mitigated
Minimal impact with proper network segmentation and monitoring detecting exploitation attempts.
🎯 Exploit Status
Public proof-of-concept available on GitHub demonstrates exploitation via HTTP POST request.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Tenda website for firmware updates beyond 3.0.0.6(3948)
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Visit Tenda support website. 2. Download latest firmware for W12 model. 3. Access router admin interface. 4. Upload and apply firmware update. 5. Reboot router.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router administration interface
Network segmentation
allIsolate router management interface to trusted network segment
🧯 If You Can't Patch
- Replace vulnerable router with updated model or different vendor
- Implement strict firewall rules blocking all external access to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface matches 3.0.0.6(3948)Check Version:
Login to router admin interface and check firmware version in system statusVerify Fix Applied:
Confirm firmware version has changed from 3.0.0.6(3948) after update📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/modules with wifiScheduledSet parameter
- Router crash/reboot events in system logs
Network Indicators:
- HTTP traffic to router management interface with suspicious POST parameters
- Sudden loss of router connectivity
SIEM Query:
source="router_logs" AND (uri="/goform/modules" AND method="POST" AND params CONTAINS "wifiScheduledSet")🔗 References
- https://github.com/z472421519/BinaryAudit/blob/main/PoC/NPD/Tenda_W12/cgiWifiScheduledSet/cgiWifiScheduledSet.md
- https://vuldb.com/?ctiid.327709
- https://vuldb.com/?id.327709
- https://vuldb.com/?submit.670118
- https://www.tenda.com.cn/
- https://github.com/z472421519/BinaryAudit/blob/main/PoC/NPD/Tenda_W12/cgiWifiScheduledSet/cgiWifiScheduledSet.md
