CVE-2025-63458

Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the timeZone parameter in the form_fast_setting_wifi_set function

High · published October 31, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
32.7
In the wild
Unconfirmed
What it is

⚡ A crafty request can cause a stack overflow in Tenda AX-1803! This vulnerability could lead to a Denial of Service (DoS) that knocks your network offline! 🔥 Think of this like a waiter who keeps bringing out more and more orders without checking if the kitchen can handle it—eventually, the kitchen gets overwhelmed and can't serve anything! An attacker could exploit this vulnerability to flood the device with requests, causing it to crash and leave your users in the lurch. That's a serious downtime scenario that could disrupt your operations and frustrate your customers!

Put simply

Think of this like a waiter who keeps bringing out more and more orders without checking if the kitchen can handle it—eventually, the kitchen gets overwhelmed and can't serve anything! This vulnerability occurs in the 'form_fast_setting_wifi_set' function, where the 'timeZone' parameter can trigger a stack overflow, leading to a Denial of Service condition when a malicious request is sent.

What to do

An attacker could exploit this vulnerability to flood the device with requests, causing it to crash and leave your users in the lurch. That's a serious downtime scenario that could disrupt your operations and frustrate your customers! Update your Tenda AX-1803 to version 1.0.0.2 or later to address this stack overflow issue. Additionally, consider implementing request validation and rate limiting to mitigate the risk of future DoS attacks. 🛡️ You've got this! Follow these steps, and your network will be back in action in no time! 💪🎉

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00397 · 32.7th percentile
Published
2025-10-31T00:00Z
EPSS history
Timeline
  • 31 OCT 00:00Z
    Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the timeZone parameter in the form_fast_setting_wifi_set function
    cvelistv5