CVE-2025-69762

Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the list parameter, which can cause memory corruption and enable remote code…

Critical · published January 21, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
59.1
In the wild
Unconfirmed
What it is

🚨 A sneaky stack overflow in Tenda AX3's firmware lets attackers inject malicious code through the list parameter! 🔥 Think of it like a restaurant running out of space in the kitchen. If the chef keeps shoving in more ingredients than the counter can handle, everything could spill over and create chaos! An attacker could exploit this overflow to corrupt memory and execute remote code, giving them control over your device! This is absolutely devastating as it can lead to unauthorized access and manipulation of your network. Protecting your digital domain is crucial!

Put simply

Think of it like a restaurant running out of space in the kitchen. If the chef keeps shoving in more ingredients than the counter can handle, everything could spill over and create chaos! The vulnerability arises in the `formSetIptv` function, where improper handling of the list parameter allows for a stack overflow, potentially leading to memory corruption and remote code execution.

What to do

An attacker could exploit this overflow to corrupt memory and execute remote code, giving them control over your device! This is absolutely devastating as it can lead to unauthorized access and manipulation of your network. Protecting your digital domain is crucial! Immediately update the Tenda AX3 firmware to version 16.03.12.12 or later. Conduct a thorough audit of your device settings, ensuring no unauthorized configurations are in place. Stay vigilant about your network's security! You've got this! By following these steps, you'll secure your devices and keep the bad guys at bay! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00893 · 59.1th percentile
Published
2026-01-21T00:00Z
EPSS history
Timeline
  • 21 JAN 00:00Z
    Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the list parameter, which can cause memory corruption and enable remote code…
    cvelistv5