CVE-2025-70746

Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the timeZone parameter of the fromSetSysTime function

High · published January 16, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
37.7
In the wild
Unconfirmed
What it is

⚡ A stack overflow in Tenda AX-1806 can knock your device out cold! This means that a single crafty request could trigger a Denial of Service. 🔥 Think of it like a car engine that suddenly chokes on too much fuel, causing it to stall and refuse to start again. In this case, the timeZone parameter is the fuel gauge – it just can't handle a too-heavy load! If exploited, an attacker can cause complete downtime of your device, leaving you without internet access. This could disrupt home networks, security cameras, and even smart devices, putting your connected lifestyle at a standstill.

Put simply

Think of it like a car engine that suddenly chokes on too much fuel, causing it to stall and refuse to start again. In this case, the timeZone parameter is the fuel gauge – it just can't handle a too-heavy load! The vulnerability exists in the fromSetSysTime function, where a malformed request targeting the timeZone parameter can lead to a stack overflow, resulting in a crash of the device.

What to do

If exploited, an attacker can cause complete downtime of your device, leaving you without internet access. This could disrupt home networks, security cameras, and even smart devices, putting your connected lifestyle at a standstill. To remediate this issue, update your Tenda AX-1806 to the latest firmware version immediately. Additionally, restrict access to the device's management interface to trusted users only to minimize potential attacks. You've got this! With a quick update, you can keep your device safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00445 · 37.7th percentile
Published
2026-01-16T00:00Z
EPSS history
Timeline
  • 16 JAN 00:00Z
    Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the timeZone parameter of the fromSetSysTime function
    cvelistv5