CVE-2025-55606
Published: 22 August 2025
Summary
CVE-2025-55606 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Tenda Ax3 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-55606 is a buffer overflow vulnerability (CWE-120) affecting the Tenda AX3 router running firmware version V16.03.12.10_CN. The issue resides in the fromAdvSetMacMtuWan function, which can be triggered via the serverName parameter. It has a CVSS v3.1 base score of 7.5, rated as high severity due to its network accessibility and potential for disruption.
Unauthenticated attackers with network access can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation leads to a denial-of-service condition (high availability impact) by causing the device to crash or reboot, with no impact on confidentiality or integrity.
References for this vulnerability include GitHub documentation at https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_44/44.md, which provides details on the issue. No specific patches or mitigation steps are detailed in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28604
Vulnerability details
Tenda AX3 V16.03.12.10_CN is vulnerable to Buffer Overflow in the fromAdvSetMacMtuWan function via the serverName parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow vulnerability in the web interface of Tenda AX3 router (public-facing application) enables remote code execution via exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires organizations to identify, report, and correct software flaws like this buffer overflow in the fromAdvSetMacMtuWan function in a timely manner through patching.
Mandates validation of all information inputs, directly preventing buffer overflows triggered by oversized or malformed serverName parameters.
Implements memory protections such as stack guards and address space layout randomization to mitigate the impact of buffer overflow exploits leading to crashes.