CVE-2025-63149

Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the urls parameter of the get_parentControl_list_Info function

High · published November 10, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
32.7
In the wild
Unconfirmed
What it is

⚡ A crafty stack overflow lurks in the Tenda AX3, waiting for the right crafted request to pull the rug out from under your network! Think of it like an overflowing inbox that crashes the email server — one too many messages and everything grinds to a halt. This vulnerability can lead to a Denial of Service, leaving users cut off from their internet lifeline! If exploited, an attacker could flood the device with malicious requests, causing your network to become unresponsive. Imagine your internet service dropping out just when you needed it most — frustrating, and potentially devastating for remote work or online activities!

Put simply

Think of it like an overflowing inbox that crashes the email server — one too many messages and everything grinds to a halt. This vulnerability can lead to a Denial of Service, leaving users cut off from their internet lifeline! This vulnerability arises from a stack overflow in the 'urls' parameter of the 'get_parentControl_list_Info' function, allowing attackers to send specially crafted requests that overflow memory and crash the service.

What to do

If exploited, an attacker could flood the device with malicious requests, causing your network to become unresponsive. Imagine your internet service dropping out just when you needed it most — frustrating, and potentially devastating for remote work or online activities! To protect your network, update your Tenda AX3 to the latest firmware version immediately. Keep an eye on vendor announcements for patches, and consider implementing network-level protections to filter out malicious requests. You've got this! Follow these steps to shore up your defenses and keep your network running smoothly. 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00397 · 32.7th percentile
Published
2025-11-10T00:00Z
EPSS history
Timeline
  • 10 NOV 00:00Z
    Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the urls parameter of the get_parentControl_list_Info function
    cvelistv5