EUVD-2025-16791
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability was found in Tenda RX3 16.03.13.11_multi_TDE01. It has been rated as critical. This issue affects the function save_staticroute_data of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Analysis
Critical stack-based buffer overflow vulnerability in Tenda RX3 router firmware version 16.03.13.11_multi_TDE01, affecting the static route configuration endpoint. An authenticated remote attacker can exploit this vulnerability through manipulation of the 'list' argument in /goform/SetStaticRouteCfg to achieve code execution with full system privileges (confidentiality, integrity, and availability impact). Public exploit code exists and the vulnerability has been disclosed, creating immediate exploitation risk despite requiring authenticated access.
Technical Context
The vulnerability exists in the save_staticroute_data function within the Tenda RX3 web management interface (/goform/SetStaticRouteCfg endpoint). It is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic stack-based buffer overflow. The affected product is CPE: cpe:2.3:o:tenda:rx3_firmware:16.03.13.11_multi_tde01:*:*:*:*:*:*:* (Tenda RX3 router running firmware version 16.03.13.11_multi_TDE01). The vulnerability stems from insufficient input validation on the 'list' parameter when processing static route configuration data, allowing an attacker to write beyond allocated buffer boundaries on the stack, potentially overwriting return addresses or other critical data structures.
Affected Products
RX3 (16.03.13.11_multi_TDE01)
Remediation
Immediate actions: (1) Check Tenda's official security advisory at https://www.tenda.com.cn for patched firmware versions beyond 16.03.13.11_multi_TDE01; (2) If patched firmware is available, upgrade RX3 devices through the web UI (System Tools > Firmware Upgrade) or download from Tenda's support portal; (3) Temporary mitigation (if patching unavailable): Restrict access to the router's web management interface using firewall rules, disable remote management if enabled, and enforce strong authentication credentials to reduce attack surface. (4) Monitor for signs of compromise (unexpected routing table changes, unusual traffic patterns, system crashes). Vendor patch status and timeline were not provided in the available intelligence; immediate contact with Tenda support is recommended to obtain patched firmware.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today