Tenda M3 /goform/getMasterPassengerAnalyseData File Stack Buffer Overflow Vulnerability

Tenda M3 is a wireless controller AC from Tenda, which is aimed at scenarios such as hotel chains, low-star hotels and small and medium-sized businesses. Tenda M3 there is a stack buffer overflow vulnerability, the vulnerability stems from /goform/getMasterPassengerAnalyseData file in the...

CVE-2025-9299

CVE-2025-9299 affects Tenda M3 1.0.0.12. The vulnerability is in the /goform/getMasterPassengerAnalyseData::formGetMasterPassengerAnalyseData function, where unsafely handling the Time parameter allows a stack-based buffer overflow. This can be triggered remotely; the exploit has been disclosed p...