---
id: CVE-2025-11550
title: A vulnerability was found in Tenda W12 3.0.0.6(3948)
summary: >-
  A vulnerability was found in Tenda W12 3.0.0.6(3948). The impacted element is
  the function wifiScheduledSet of the file /goform/modules of the component
  HTTP Request Handler. The manipulation of the argument wifiScheduledSet
  results in n…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-404
  - CWE-476
  - CWE-476
vendor: tenda
product: w12_firmware
affected:
  - w12_firmware = 3.0.0.6(3948)
published: '2025-10-09'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T13:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-11550'
references:
  - url: >-
      https://github.com/z472421519/BinaryAudit/blob/main/PoC/NPD/Tenda_W12/cgiWifiScheduledSet/cgiWifiScheduledSet.md
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?ctiid.327709'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?id.327709'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?submit.670118'
    label: cna@vuldb.com
  - url: 'https://www.tenda.com.cn/'
    label: cna@vuldb.com
  - url: >-
      https://github.com/z472421519/BinaryAudit/blob/main/PoC/NPD/Tenda_W12/cgiWifiScheduledSet/cgiWifiScheduledSet.md
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00956
epssPercentile: 0.60203
ingestedAt: '2026-10-08T13:42:55.055Z'
---

## Overview

A vulnerability was found in Tenda W12 3.0.0.6(3948). The impacted element is the function wifiScheduledSet of the file /goform/modules of the component HTTP Request Handler. The manipulation of the argument wifiScheduledSet results in null pointer dereference. The attack may be performed from remote. The exploit has been made public and could be used.

## Affected

- `w12_firmware = 3.0.0.6(3948)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.