CVE-2025-11549
A vulnerability has been found in Tenda W12 3.0.0.6(3948). The affected element is the function wifiMacFilterSet of the file /goform/modules
CVSS
8.8
Alto
EPSS
8.9%
p95
KEV
—
Exploit Today
29
0-100
Publicado: 9 oct 2025 · Última mod.: 8 oct 2026 · CWE-119 · CWE-121
8.5%EPSS · 30 días8.9%
2026-10-142026-11-11
A vulnerability has been found in Tenda W12 3.0.0.6(3948). The affected element is the function wifiMacFilterSet of the file /goform/modules of the component HTTP Request Handler. The manipulation of the argument mac leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
- github.comhttps://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_W12/cgiWifiMacFilterSet/cgiWifiMacFilterSet.md
- vuldb.comhttps://vuldb.com/?ctiid.327708
- vuldb.comhttps://vuldb.com/?id.327708
- vuldb.comhttps://vuldb.com/?submit.670110
- www.tenda.com.cnhttps://www.tenda.com.cn/
- github.comhttps://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_W12/cgiWifiMacFilterSet/cgiWifiMacFilterSet.md
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-126917——
———Memory corruption in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)5hCVE-2026-1262587.5 ALT—
———A stack-based buffer overflow vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.7 may allow an unauthenticated attacker with wad port access to crash proxy or ZTNA sessions via crafted HTTP or HTTPS requests.6hCVE-2026-1262397.5 ALT—
———A stack-based buffer overflow vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to crash the FSSO subsystem via crafted http requests6hCVE-2026-1262237.2 ALT—
———A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests.6hCVE-2026-109163——
———Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292)
This issue affects Apache HTTP Server: 2.4.69.13hCVE-2026-1135127.8 ALT27.4%
——8After Effects is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.17h