CVE-2025-9298

A flaw has been found in Tenda M3 1.0.0.12. Affected is the function formQuickIndex of the file /goform/QuickIndex. Executing manipulation of the argument PPPOEPassword can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.

• CWE-119
• CWE-121

• https://github.com/davybat/IoT-Vuls/blob/main/tenda/formQuickIndex.mdExploit, Third Party Advisory
• https://github.com/davybat/IoT-Vuls/blob/main/tenda/formQuickIndex.md#pocExploit, Third Party Advisory
• https://vuldb.com/?ctiid.320903Permissions Required, VDB Entry
• https://vuldb.com/?id.320903Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.632335Third Party Advisory, VDB Entry
• https://www.tenda.com.cn/Product
• https://github.com/davybat/IoT-Vuls/blob/main/tenda/formQuickIndex.mdExploit, Third Party Advisory
• https://github.com/davybat/IoT-Vuls/blob/main/tenda/formQuickIndex.md#pocExploit, Third Party Advisory

Published

Aug 21, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9291A certification validation weakness exists in communication …6.5
• CVE-2025-9292A permissive web security configuration may allow cross-orig…7.5
• CVE-2025-9293A vulnerability in the certificate validation logic may allo…8.1
• CVE-2025-9294The Quiz and Survey Master (QSM) – Easy Quiz and Survey Make…4.3
• CVE-2025-9296A security vulnerability has been detected in Emlog Pro up t…9.8
• CVE-2025-9297A vulnerability was detected in Tenda i22 1.0.0.3(4687). Thi…8.8
• CVE-2025-9299A vulnerability has been found in Tenda M3 1.0.0.12. Affecte…9.8
• CVE-2025-9300A vulnerability was found in saitoha libsixel up to 1.10.3. …7.8
• CVE-2025-9301A vulnerability was determined in cmake 4.1.20250725-gb5cce2…3.3
• CVE-2025-9302A vulnerability was identified in PHPGurukul User Management…9.8
• CVE-2025-9303A security flaw has been discovered in TOTOLINK A720R 4.1.5c…9.8
• CVE-2025-9304A weakness has been identified in SourceCodester Online Bank…9.8