CVE-2025-7418
published 2025-07-10CVE-2025-7418: A vulnerability was found in Tenda O3V2 1.0.0.12(3880) and classified as critical. Affected by this issue is the function fromPingResultGet of the file…
PriorityP264high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.96%
61.2th percentile
A vulnerability was found in Tenda O3V2 1.0.0.12(3880) and classified as critical. Affected by this issue is the function fromPingResultGet of the file /goform/setPing of the component httpd. The manipulation of the argument destIP leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tenda | o3_firmware | — | — |
| tenda | o3v2 | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-1736 php: Stream HTTP wrapper header check might omit basic auth header
bugzilla·2025-03-30·CVSS 7.3
CVE-2025-1736 [HIGH] CVE-2025-1736 php: Stream HTTP wrapper header check might omit basic auth header
CVE-2025-1736 php: Stream HTTP wrapper header check might omit basic auth header
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:4263 https://access.redhat.com/errata/RHSA-2025:4263
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:7418 https://access.redhat.com/errata/RHSA-2025:7418
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via R
Bugzilla
CVE-2025-1219 php: libxml streams use wrong content-type header when requesting a redirected resource
bugzilla·2025-03-30·CVSS 5.3
CVE-2025-1219 [MEDIUM] CVE-2025-1219 php: libxml streams use wrong content-type header when requesting a redirected resource
CVE-2025-1219 php: libxml streams use wrong content-type header when requesting a redirected resource
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:4263 https://access.redhat.com/errata/RHSA-2025:4263
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:7418 https://access.redhat.com/errata/RHSA-20
Bugzilla
CVE-2025-1861 php: Stream HTTP wrapper truncates redirect location to 1024 bytes
bugzilla·2025-03-30·CVSS 9.8
CVE-2025-1861 [CRITICAL] CVE-2025-1861 php: Stream HTTP wrapper truncates redirect location to 1024 bytes
CVE-2025-1861 php: Stream HTTP wrapper truncates redirect location to 1024 bytes
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:4263 https://access.redhat.com/errata/RHSA-2025:4263
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:7418 https://access.redha
https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_51/51.mdhttps://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_51/51.md#pochttps://vuldb.com/?ctiid.315878https://vuldb.com/?id.315878https://vuldb.com/?submit.608864https://www.tenda.com.cn/https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_51/51.mdhttps://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_51/51.md#poc
2025-07-10
Published