CVE-2025-65804
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Tenda AX3 v16.03.12.11 contains a stack overflow in formSetIptv via the iptvType parameter. It can cause memory corruption and enable remote code execution (RCE).
Risk Assessment
A remote attacker can execute arbitrary code on the device, taking control of it. This poses a serious threat to network security.
Recommendation
Update Tenda AX3 firmware to the latest version if a fix is available. Otherwise, consider restricting access to the management interface.
Other vulnerabilities in Tenda AX3
See all- CVE-2025-69764Critical
Tenda AX3 firmware v16.03.12.11 contains a stack-based buffer overflow in the formGetIptv function due to improper handling of the stbpvid stack buffer, which may result in memory corruption and remote code execution.
- CVE-2025-69766Critical
Tenda AX3 firmware v16.03.12.11 contains a stack-based buffer overflow in the formGetIptv function due to improper handling of the citytag stack buffer, which may result in memory corruption and remote code execution.
- CVE-2025-69763Critical
Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the vlanId parameter, which can cause memory corruption and enable remote code execution.
- CVE-2025-69762Critical
Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the list parameter, which can cause memory corruption and enable remote code execution.
- CVE-2025-63152High
Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the wpapsk_crypto parameter of the wlSetExternParameter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
- CVE-2023-40915High
Tenda AX3 v16.03.12.11 has a stack buffer overflow vulnerability detected at function form_fast_setting_wifi_set. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ssid parameter.
Original NVD description (English source)
Tenda AX3 v16.03.12.11 contains a stack overflow in formSetIptv via the iptvType parameter, which can cause memory corruption and enable remote code execution (RCE).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS