CVE-2025-69766

9.8 criticalEPSS 0.8%

Critical (9.8) in tenda ax3 firmware. EPSS 0.8% chance of exploitation in the next 30 days.

Tenda AX3 firmware v16.03.12.11 contains a stack-based buffer overflow in the formGetIptv function due to improper handling of the citytag stack buffer, which may result in memory corruption and remote code execution.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
CWE: CWE-121
Published: 2026-01-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

tenda:ax3_firmware

References

https://river-brow-763.notion.site/Tenda-AX3-Buffer-Overflow-in-formGetIptv-2c9a595a7aef8043a091e6722b8e255a
https://river-brow-763.notion.site/Tenda-AX3-Buffer-Overflow-in-formGetIptv-2c9a595a7aef8043a091e6722b8e255a?source=copy_link

Check your stack JSON