Tenda
Tenda AX3 Firmware: vulnerabilidades y CVE
Tenda AX3 Firmware tiene 53 vulnerabilidades publicadas, 16 de ellas en los últimos 12 meses. 16 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE53
Últimos 12 meses16
Críticas16
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-69765 | Alta (7.5) | 0.77% | — | 3 mar 2026 | Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formGetIptv function and the list parameter, which can cause memory corruption and enable remote code execution. |
| CVE-2025-69764 | Crítica (9.8) | 1.1% | — | 22 ene 2026 | Tenda AX3 firmware v16.03.12.11 contains a stack-based buffer overflow in the formGetIptv function due to improper handling of the stbpvid stack buffer, which may result in memory corruption and remote code execution. |
| CVE-2025-69766 | Crítica (9.8) | 0.79% | — | 21 ene 2026 | Tenda AX3 firmware v16.03.12.11 contains a stack-based buffer overflow in the formGetIptv function due to improper handling of the citytag stack buffer, which may result in memory corruption and remote code execution. |
| CVE-2025-69763 | Crítica (9.8) | 0.91% | — | 21 ene 2026 | Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the vlanId parameter, which can cause memory corruption and enable remote code execution. |
| CVE-2025-69762 | Crítica (9.8) | 0.91% | — | 21 ene 2026 | Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the list parameter, which can cause memory corruption and enable remote code execution. |
| CVE-2025-71027 | Alta (7.5) | 0.45% | — | 13 ene 2026 | Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the wanMTU2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted… |
| CVE-2025-71026 | Alta (7.5) | 0.45% | — | 13 ene 2026 | Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the wanSpeed2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted… |
| CVE-2025-71025 | Alta (7.5) | 0.45% | — | 13 ene 2026 | Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the cloneType2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted… |
| CVE-2025-71024 | Alta (7.5) | 0.45% | — | 13 ene 2026 | Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the serviceName2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a… |
| CVE-2025-71023 | Alta (7.5) | 0.45% | — | 13 ene 2026 | Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the mac2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted… |
| CVE-2025-65804 | Media (6.5) | 0.55% | — | 8 dic 2025 | Tenda AX3 v16.03.12.11 contains a stack overflow in formSetIptv via the iptvType parameter, which can cause memory corruption and enable remote code execution (RCE). |
| CVE-2025-63149 | Alta (7.5) | 0.37% | — | 10 nov 2025 | Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the urls parameter of the get_parentControl_list_Info function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a… |
| CVE-2025-63455 | Alta (7.5) | 0.38% | — | 10 nov 2025 | Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a… |
| CVE-2025-63147 | Alta (7.5) | 0.37% | — | 10 nov 2025 | Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the deviceId parameter of the saveParentControlInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted… |
| CVE-2025-63152 | Alta (7.5) | 0.37% | — | 10 nov 2025 | Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the wpapsk_crypto parameter of the wlSetExternParameter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a… |
| CVE-2025-63454 | Alta (7.5) | 0.40% | — | 31 oct 2025 | Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the deviceId parameter in the get_parentControl_list_Info function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a… |
| CVE-2025-55606 | Alta (7.5) | 0.41% | — | 22 ago 2025 | Tenda AX3 V16.03.12.10_CN is vulnerable to Buffer Overflow in the fromAdvSetMacMtuWan function via the serverName parameter. |
| CVE-2025-55605 | Alta (7.5) | 0.41% | — | 22 ago 2025 | Tenda AX3 V16.03.12.10_CN is vulnerable to Buffer Overflow in the saveParentControlInfo function via the deviceName parameter. |
| CVE-2025-55603 | Alta (7.5) | 0.41% | — | 22 ago 2025 | Tenda AX3 V16.03.12.10_CN is vulnerable to Buffer Overflow in the fromSetSysTime function via the ntpServer parameter. |
| CVE-2023-47422 | Alta (8.8) | 0.49% | — | 20 feb 2024 | An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 V1 V22.03.01.46, and Tenda AX12 V1 V22.03.01.46 allows attackers to bypass authentication on any endpoint via… |
| CVE-2023-51812 | Crítica (9.8) | 1.1% | — | 4 ene 2024 | Tenda AX3 v16.03.12.11 was discovered to contain a remote code execution (RCE) vulnerability via the list parameter at /goform/SetNetControlList. |
| CVE-2023-49409 | Crítica (9.8) | 1.5% | — | 7 dic 2023 | Tenda AX3 V16.03.12.11 was discovered to contain a Command Execution vulnerability via the function /goform/telnet. |
| CVE-2023-49408 | Crítica (9.8) | 0.92% | — | 7 dic 2023 | Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the function set_device_name. |
| CVE-2023-40915 | Alta (7.5) | 0.74% | — | 25 ago 2023 | Tenda AX3 v16.03.12.11 has a stack buffer overflow vulnerability detected at function form_fast_setting_wifi_set. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ssid parameter. |
| CVE-2023-27042 | Alta (8.8) | 0.90% | — | 24 mar 2023 | Tenda AX3 V16.03.12.11 is vulnerable to Buffer Overflow via /goform/SetFirewallCfg. |
| CVE-2023-27240 | Crítica (9.8) | 2.8% | — | 15 mar 2023 | Tenda AX3 V16.03.12.11 was discovered to contain a command injection vulnerability via the lanip parameter at /goform/AdvSetLanip. |
| CVE-2023-27239 | Crítica (9.8) | 0.84% | — | 15 mar 2023 | Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the shareSpeed parameter at /goform/WifiGuestSet. |
| CVE-2023-24212 | Crítica (9.8) | 1.1% | — | 23 feb 2023 | Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the timeType function at /goform/SetSysTimeCfg. |
| CVE-2022-24995 | Crítica (9.8) | 14% | — | 10 mar 2022 | Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Service (DoS) via the time parameter. |
| CVE-2021-46394 | Crítica (9.8) | 2.7% | — | 4 mar 2022 | There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. The v13 variable is directly retrieved from the http request parameter startIp. Then v13 will be… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.