CVE-2025-63147

Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the deviceId parameter of the saveParentControlInfo function

Medium · published November 10, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
32.7
In the wild
Unconfirmed
What it is

⚠️ A stack overflow in your Tenda AX3 could wipe out your internet connection with just one crafty request! Think of it like a restaurant with a reservation system that malfunctions — one hiccup leads to a flood of customers arriving at the same time, causing chaos and a complete service shutdown! This vulnerability allows attackers to trigger a Denial of Service (DoS), leaving your trusty router overwhelmed and your home network effectively offline. Imagine trying to stream your favorite show, only to find the Wi-Fi is down due to this sneaky glitch!

Put simply

Think of it like a restaurant with a reservation system that malfunctions — one hiccup leads to a flood of customers arriving at the same time, causing chaos and a complete service shutdown! The stack overflow occurs in the deviceId parameter of the saveParentControlInfo function, allowing an attacker to craft a specific request that can cause the device to crash or become unresponsive.

What to do

This vulnerability allows attackers to trigger a Denial of Service (DoS), leaving your trusty router overwhelmed and your home network effectively offline. Imagine trying to stream your favorite show, only to find the Wi-Fi is down due to this sneaky glitch! To safeguard your network, update your Tenda AX3 firmware to the latest version immediately. If an update isn't available, consider disabling the affected feature until a fix is released. Regularly check for updates to stay ahead! You've got this! Secure your device and keep the internet flowing smoothly! 🛡️

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00397 · 32.7th percentile
Published
2025-11-10T00:00Z
EPSS history
Timeline
  • 10 NOV 00:00Z
    Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the deviceId parameter of the saveParentControlInfo function
    cvelistv5