CVE-2025-11550

published 2025-10-09

CVE-2025-11550: A vulnerability was found in Tenda W12 3.0.0.6(3948). The impacted element is the function wifiScheduledSet of the file /goform/modules of the component HTTP…

medium 5.7 CVSS 4.0

AV N AC L AT N PR L UI N VC N VI N VA H SC N SI N SA N E P CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A vulnerability was found in Tenda W12 3.0.0.6(3948). The impacted element is the function wifiScheduledSet of the file /goform/modules of the component HTTP Request Handler. The manipulation of the argument wifiScheduledSet results in null pointer dereference. The attack may be performed from remote. The exploit has been made public and could be used.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
msrc	azl3_libid3tag_0.16.3-7_on_azure_linux_3.0	—	—
msrc	cbl2_libid3tag_0.15.1b-33_on_cbl_mariner_2.0	—	—
tenda	w12	—	—
tenda	w12_firmware	—	—

CWE-404 CWE-476