CVE-2025-11550

🗓️ 09 Oct 2025 18:02:06Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 3 Views🌐 WEB

Tenda W12 remote vulnerability in wifiScheduledSet of web request handler causing null pointer dereference; exploit published.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-11550	9 Oct 202518:36	–	circl
CNNVD	Tenda W12 安全漏洞	9 Oct 202500:00	–	cnnvd
CNVD	Tenda W12 Null Pointer Dereference Vulnerability	15 Oct 202500:00	–	cnvd
Cvelist	CVE-2025-11550 Tenda W12 HTTP Request modules wifiScheduledSet null pointer dereference	9 Oct 202518:02	–	cvelist
EUVD	EUVD-2025-33411	9 Oct 202518:30	–	euvd
NVD	CVE-2025-11550	9 Oct 202518:15	–	nvd
OSV	CVE-2025-11550	9 Oct 202518:15	–	osv
Positive Technologies	PT-2025-41445	9 Oct 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-11550	10 Oct 202518:27	–	redhatcve
Vulnrichment	CVE-2025-11550 Tenda W12 HTTP Request modules wifiScheduledSet null pointer dereference	9 Oct 202518:02	–	vulnrichment

NVD

Node

tenda w12_firmwareMatch3.0.0.6(3948)

AND

tenda w12Match3.0

[
  {
    "vendor": "Tenda",
    "product": "W12",
    "versions": [
      {
        "version": "3.0.0.6(3948)",
        "status": "affected"
      }
    ],
    "cpes": [
      "cpe:2.3:o:tenda:w12_firmware:*:*:*:*:*:*:*:*"
    ],
    "modules": [
      "HTTP Request Handler"
    ]
  }
]

Source	Link
tenda	www.tenda.com.cn/
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
github	www.github.com/z472421519/BinaryAudit/blob/main/PoC/NPD/Tenda_W12/cgiWifiScheduledSet/cgiWifiScheduledSet.md
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
wifiScheduledSet	request body	/goform/modules	Null pointer dereference via wifiScheduledSet parameter in wifiScheduledSet function of /goform/modules, enabling remote exploitation.	CWE-476, CWE-404

29 Apr 2026 01:00Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.16.5

CVSS 26.8

CVSS 47.1

CVSS 36.5

EPSS0.00085

SSVC