CVE-2025-69762
Published: 21 January 2026
Summary
CVE-2025-69762 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Tenda Ax3 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 47.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-69762 is a stack-based buffer overflow vulnerability (CWE-121) in Tenda AX3 firmware version 16.03.12.11, affecting the formSetIptv function when processing the "list" parameter. Published on 2026-01-21, this flaw causes memory corruption, enabling potential remote code execution. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its high impact on confidentiality, integrity, and availability.
Attackers can exploit this vulnerability remotely over the network without authentication, privileges, or user interaction, requiring only low complexity. Successful exploitation allows arbitrary code execution on the router, potentially granting full control over the device, including data theft, traffic manipulation, or use as a pivot for further network compromise.
Advisories and detailed analysis are available in the referenced Notion pages, including https://river-brow-763.notion.site/Tenda-AX3-Buffer-Overflow-in-formSetIptv-2c9a595a7aef80718ff2c3869d32392d and https://river-brow-763.notion.site/Tenda-AX3-Buffer-Overflow-in-formSetIptv-2c9a595a7aef80718ff2c3869d32392d?pvs=74, which cover the buffer overflow in formSetIptv.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3604
Vulnerability details
Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the list parameter, which can cause memory corruption and enable remote code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remotely exploitable buffer overflow in router firmware, enabling unauthenticated remote code execution on a public-facing network device, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents stack overflows by validating the 'list' parameter length and format in formSetIptv to avoid memory corruption.
Mitigates exploitation of the stack overflow through memory protections like stack canaries, ASLR, and non-executable memory to block remote code execution.
Requires timely firmware patching to remediate the specific stack overflow flaw in Tenda AX3 v16.03.12.11, eliminating the vulnerability.