CVE-2025-11550: tenda w12_firmware Improper Resource Shutdown or Release

Vulnerability summary

CVE-2025-11550 is a high (CVSS 7.1) Improper Resource Shutdown or Release vulnerability in tenda w12_firmware. EPSS estimates a 0.96% chance of exploitation in the next 30 days, higher than 60.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 09-10-2025
   PublishedVulnerability first disclosed.
2. 24-02-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in Tenda W12 3.0.0.6(3948). The impacted element is the function wifiScheduledSet of the file /goform/modules of the component HTTP Request Handler. The manipulation of the argument wifiScheduledSet results in null pointer dereference. The attack may be performed from remote. The exploit has been made public and could be used.

• CWE-404Improper Resource Shutdown or ReleaseThe product does not release or incorrectly releases a resource before it is made available for re-use.
• CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.