CVE-2025-57569
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A buffer overflow vulnerability has been discovered in the Tenda F3 router version V12.01.01.48_multi and later. The issue resides in the portList parameter of the /goform/setNAT endpoint.
Risk Assessment
An attacker can remotely crash the device or potentially execute arbitrary code, leading to full compromise of the router and network security.
Recommendation
Immediately update the Tenda F3 firmware to the latest patched version if available. Restrict management interface access to trusted networks as a temporary mitigation.
Other vulnerabilities in Tenda F3
See all- CVE-2025-57573Medium
A buffer overflow vulnerability exists in the Tenda F3 router version V12.01.01.48_multi and later. The issue is triggered via the wifiTimeClose parameter in the goform/setWifi function.
- CVE-2025-57572Medium
A buffer overflow vulnerability exists in the Tenda F3 device version V12.01.01.48_multi and later, in the onlineList parameter of the goform/setParentControl function. An attacker can remotely cause a crash or potentially take control of the device.
- CVE-2025-57571Medium
A buffer overflow vulnerability exists in Tenda F3 router version V12.01.01.48_multi and later. The issue is triggered via the macFilterList parameter in the goform/setNAT request.
- CVE-2025-57570Medium
A buffer overflow vulnerability exists in the Tenda F3 router version V12.01.01.48_multi and later via the QosList parameter in the goform/setQoS function. An attacker can remotely crash the device or potentially gain control over it.
Original NVD description (English source)
Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the portList parameter in /goform/setNAT.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS