CVE-2025-29359
Published: 13 March 2025
Summary
CVE-2025-29359 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Tenda Rx3 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents buffer overflow by validating the deviceId parameter in /goform/saveParentControlInfo against crafted inputs.
Implements runtime memory protections like stack canaries and ASLR to block exploitation of the buffer overflow for DoS.
Requires timely remediation of the identified buffer overflow flaw through firmware patching or compensating controls.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing web endpoint (/goform/saveParentControlInfo) enables remote exploitation (T1190) leading to device crash/DoS via application exploitation (T1499.004).
NVD Description
Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the deviceId parameter at /goform/saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Deeper analysisAI
CVE-2025-29359 is a buffer overflow vulnerability (CWE-120) in the Tenda RX3 router firmware version US_RX3V1.0br_V16.03.13.11_multi_TDE01. The flaw resides in the handling of the deviceId parameter within the /goform/saveParentControlInfo endpoint, which can be triggered by specially crafted input.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating it is exploitable over the network with low complexity, no authentication or user interaction required. Remote attackers can send a crafted packet to the affected endpoint, causing a denial of service by crashing the device and disrupting network availability.
Further technical details, including proof-of-concept information, are documented in the referenced analysis at https://github.com/2664521593/mycve/blob/main/Tenda/RX3/tenda_rx3_bof_6.pdf. No official vendor patches or mitigation guidance are specified in available sources.
Details
- CWE(s)