CVE-2025-63454

Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the deviceId parameter in the get_parentControl_list_Info function

High Β· published October 31, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
32.7
In the wild
Unconfirmed
What it is

⚑ A single crafted request can send your Tenda AX-3 spiraling into a stack overflow disaster! Think of it like a restaurant kitchen where an endless stream of orders comes in, overwhelming the staff until they can no longer keep up β€” chaos ensues! πŸ₯‘ If an attacker exploits this vulnerability, they could effectively shut down your router, leaving all connected devices unable to access the internet. It’s like locking the doors and throwing away the keys β€” nobody gets through! πŸ”’

Put simply

Think of it like a restaurant kitchen where an endless stream of orders comes in, overwhelming the staff until they can no longer keep up β€” chaos ensues! πŸ₯‘ This stack overflow vulnerability exists in the get_parentControl_list_Info function, triggered by a maliciously crafted deviceId parameter, resulting in a Denial of Service (DoS) condition.

What to do

If an attacker exploits this vulnerability, they could effectively shut down your router, leaving all connected devices unable to access the internet. It’s like locking the doors and throwing away the keys β€” nobody gets through! πŸ”’ To protect yourself, update your Tenda AX-3 to the latest firmware version available, ensuring this vulnerability is patched. Additionally, consider monitoring your network for unusual request patterns. πŸ›‘οΈ You've got this! Stay vigilant and keep your devices updated for a safer internet experience! πŸ’ͺ

The record
Technical detail
CVSS v3.1
7.5 Β· HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00397 Β· 32.7th percentile
Published
2025-10-31T00:00Z
EPSS history
Timeline
  • 31 OCT 00:00Z
    Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the deviceId parameter in the get_parentControl_list_Info function
    cvelistv5