CVE-2025-69764
Published: 22 January 2026
Summary
CVE-2025-69764 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Tenda Ax3 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the stack-based buffer overflow in formGetIptv by identifying, prioritizing, and applying firmware patches to eliminate the vulnerability.
Enforces validation of inputs to the stbpvid stack buffer in formGetIptv, preventing buffer overflows from malformed or oversized data.
Implements memory protections such as stack canaries and address space layout randomization to block exploitation of the stack buffer overflow leading to code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a stack-based buffer overflow in a router's web interface (formGetIptv), enabling unauthenticated remote code execution, directly mapping to T1190: Exploit Public-Facing Application.
NVD Description
Tenda AX3 firmware v16.03.12.11 contains a stack-based buffer overflow in the formGetIptv function due to improper handling of the stbpvid stack buffer, which may result in memory corruption and remote code execution.
Deeper analysisAI
CVE-2025-69764 is a stack-based buffer overflow vulnerability affecting Tenda AX3 firmware version v16.03.12.11. The flaw occurs in the formGetIptv function due to improper handling of the stbpvid stack buffer, which can lead to memory corruption and remote code execution. It is classified under CWE-121 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability was published on 2026-01-22.
An unauthenticated remote attacker with network access can exploit this vulnerability with low attack complexity and without requiring user interaction. Successful exploitation may allow the attacker to achieve remote code execution on the targeted device, resulting in high impacts to confidentiality, integrity, and availability.
Mitigation details and further technical analysis are documented in the following references: https://river-brow-763.notion.site/Tenda-AX3-Buffer-Overflow-in-formGetIptv-2c9a595a7aef80e9b90fdaa56f51374b and https://river-brow-763.notion.site/Tenda-AX3-Buffer-Overflow-in-formGetIptv-2c9a595a7aef80e9b90fdaa56f51374b?source=copy_link.
Details
- CWE(s)