CVE-2025-63149: Tenda AX3 Firmware DoS Vulnerability

CVE-2025-63149 Overview

A stack overflow vulnerability has been identified in the Tenda AX3 router firmware version V16.03.12.10_CN. The vulnerability exists within the get_parentControl_list_Info function, specifically in the handling of the urls parameter. When this parameter receives maliciously crafted input, it triggers a stack overflow condition that can lead to a Denial of Service (DoS) attack against the affected device.

This vulnerability is classified as CWE-121 (Stack-based Buffer Overflow), a memory corruption flaw where data written to the stack exceeds the allocated buffer size, potentially overwriting critical memory structures and causing system instability or crashes.

Critical Impact

Unauthenticated remote attackers can crash affected Tenda AX3 routers by sending specially crafted requests, causing network disruption for all connected devices.

Affected Products

• Tenda AX3 Router Hardware
• Tenda AX3 Firmware Version 16.03.12.10_CN
• tenda ax3_firmware

Discovery Timeline

• 2025-11-10 - CVE-2025-63149 published to NVD
• 2025-11-17 - Last updated in NVD database

Technical Details for CVE-2025-63149

Vulnerability Analysis

The stack overflow vulnerability in CVE-2025-63149 occurs within the get_parentControl_list_Info function of the Tenda AX3 firmware. This function is responsible for processing parental control list information and accepts a urls parameter as input. The root cause is insufficient bounds checking when processing this input parameter, allowing an attacker to submit data that exceeds the allocated stack buffer size.

When exploited, the overflow corrupts the stack memory, leading to program termination or device crash. Since this is a network-accessible function on a consumer router, the impact extends beyond the device itself—all users and devices connected to the router lose network connectivity when the device crashes.

The vulnerability requires no authentication to exploit, making it particularly dangerous for exposed devices. An attacker simply needs network access to the router's management interface to send the malicious request.

Root Cause

The vulnerability stems from improper input validation in the get_parentControl_list_Info function. The function allocates a fixed-size buffer on the stack to store the incoming urls parameter value but fails to verify that the input length does not exceed this buffer size before copying the data. This classic stack buffer overflow pattern allows an attacker to write beyond the intended memory boundaries.

The lack of proper bounds checking before memory copy operations is a common vulnerability in embedded systems and IoT devices where security practices may not be as rigorous as enterprise software development.

Attack Vector

The attack can be executed remotely over the network without requiring any authentication or user interaction. An attacker with network access to the Tenda AX3 router's web management interface can craft a malicious HTTP request containing an oversized urls parameter value directed at the vulnerable function.

The attack flow involves sending a request to the parental control functionality endpoint with a urls parameter containing data that exceeds the expected buffer size. When the get_parentControl_list_Info function processes this request, the oversized input overwrites adjacent stack memory, corrupting return addresses or other critical data structures, ultimately causing the device to crash.

For detailed technical analysis, refer to the GitHub Vulnerability Report.

Detection Methods for CVE-2025-63149

Indicators of Compromise

• Unexpected router reboots or crashes, particularly when accessing parental control features
• HTTP requests to the router's management interface containing abnormally long urls parameter values
• Network outages coinciding with suspicious traffic directed at the router's web interface
• Repeated device instability or service unavailability for connected clients

Detection Strategies

• Monitor HTTP traffic to the router management interface for requests with unusually large parameter values
• Implement network intrusion detection rules to flag requests targeting parental control endpoints with oversized payloads
• Set up logging on network boundaries to capture suspicious traffic patterns targeting Tenda devices
• Deploy anomaly detection to identify repeated crash-and-reboot cycles of network infrastructure devices

Monitoring Recommendations

• Enable logging on upstream network devices to capture traffic destined for Tenda AX3 management interfaces
• Monitor device uptime and availability to detect DoS attack patterns
• Review firewall logs for repeated connection attempts to router management ports (typically TCP 80/443)
• Implement network segmentation to isolate IoT and router management interfaces from untrusted networks

How to Mitigate CVE-2025-63149

Immediate Actions Required

• Restrict network access to the Tenda AX3 web management interface to trusted IP addresses only
• Disable remote management features if not required
• Place the router's management interface behind a firewall or VPN
• Monitor for firmware updates from Tenda that address this vulnerability
• Consider network segmentation to limit exposure of vulnerable devices

Patch Information

At the time of publication, no official vendor patch has been released for this vulnerability. Users should monitor the Tenda support website for firmware updates that address CVE-2025-63149. Until a patch is available, implementing the recommended workarounds and access restrictions is essential to reduce exposure risk.

For additional technical details regarding this vulnerability, see the GitHub Vulnerability Report.

Workarounds

• Configure firewall rules to block external access to the router's management interface
• Use access control lists (ACLs) to limit which IP addresses can reach the management interface
• Disable the parental control feature if not actively used to reduce attack surface
• Deploy the router behind an additional security appliance that can filter malicious requests
• Schedule regular device monitoring to quickly detect and respond to any DoS incidents

# Example firewall configuration to restrict management access
# Block external access to router management interface
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP