What is the CVSS score of CVE-2025-5527?

CVE-2025-5527 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Rx3 Firmware are affected by CVE-2025-5527?

A critical remote code execution vulnerability affecting Tenda RX3 routers (model 16.03.13.11_multi_TDE01) has been publicly disclosed with active exploits available.

Is there a public PoC exploit available for CVE-2025-5527?

Yes, a public proof-of-concept exploit is available for CVE-2025-5527. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2025-5527?

Within 24 hours: Inventory all Tenda RX3 devices in production and isolate affected units from critical networks if possible. Within 7 days: Implement network segmentation to restrict administrative access to these devices and deploy WAF/IDS rules to block exploit attempts targeting /goform/SetStaticRouteCfg. Within 30 days: Replace vulnerable Tenda RX3 units with alternative vendors or devices with available security patches, or contact Tenda for ETA on patch availability and escalate to procurement if replacement timeline exceeds risk tolerance.

Rx3 Firmware CVE-2025-5527

EUVD-2025-16791 HIGH

Buffer Overflow (CWE-119)

2025-06-03 cna@vuldb.com

Buffer Overflow Rx3 Firmware Tenda

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:04 euvd

EUVD-2025-16791

Analysis Generated

Mar 14, 2026 - 17:04 vuln.today

PoC Detected

Jun 09, 2025 - 15:11 vuln.today

Public exploit code

CVE Published

Jun 03, 2025 - 21:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in Tenda RX3 16.03.13.11_multi_TDE01. It has been rated as critical. This issue affects the function save_staticroute_data of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical stack-based buffer overflow vulnerability in Tenda RX3 router firmware version 16.03.13.11_multi_TDE01, affecting the static route configuration endpoint. An authenticated remote attacker can exploit this vulnerability through manipulation of the 'list' argument in /goform/SetStaticRouteCfg to achieve code execution with full system privileges (confidentiality, integrity, and availability impact). Public exploit code exists and the vulnerability has been disclosed, creating immediate exploitation risk despite requiring authenticated access.

Technical ContextAI

The vulnerability exists in the save_staticroute_data function within the Tenda RX3 web management interface (/goform/SetStaticRouteCfg endpoint). It is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic stack-based buffer overflow. The affected product is CPE: cpe:2.3:o:tenda:rx3_firmware:16.03.13.11_multi_tde01:*:*:*:*:*:*:* (Tenda RX3 router running firmware version 16.03.13.11_multi_TDE01). The vulnerability stems from insufficient input validation on the 'list' parameter when processing static route configuration data, allowing an attacker to write beyond allocated buffer boundaries on the stack, potentially overwriting return addresses or other critical data structures.

RemediationAI

Immediate actions: (1) Check Tenda's official security advisory at https://www.tenda.com.cn for patched firmware versions beyond 16.03.13.11_multi_TDE01; (2) If patched firmware is available, upgrade RX3 devices through the web UI (System Tools > Firmware Upgrade) or download from Tenda's support portal; (3) Temporary mitigation (if patching unavailable): Restrict access to the router's web management interface using firewall rules, disable remote management if enabled, and enforce strong authentication credentials to reduce attack surface. (4) Monitor for signs of compromise (unexpected routing table changes, unusual traffic patterns, system crashes). Vendor patch status and timeline were not provided in the available intelligence; immediate contact with Tenda support is recommended to obtain patched firmware.