CVE-2025-71024: Tenda AX-3 Router DoS Vulnerability

CVE-2025-71024 Overview

A stack overflow vulnerability has been discovered in the Tenda AX-3 v16 router firmware. The vulnerability exists in the serviceName2 parameter of the fromAdvSetMacMtuWan function. When exploited, this vulnerability allows attackers to cause a Denial of Service (DoS) condition on affected devices by sending specially crafted HTTP requests to the router's web management interface.

Critical Impact

Attackers can remotely crash Tenda AX-3 routers by exploiting the stack overflow in the fromAdvSetMacMtuWan function, causing network disruption for all connected devices.

Affected Products

• Tenda AX-3 v16.03.12.10_CN

Discovery Timeline

• January 13, 2026 - CVE CVE-2025-71024 published to NVD
• January 13, 2026 - Last updated in NVD database

Technical Details for CVE-2025-71024

Vulnerability Analysis

This vulnerability is a classic stack overflow condition affecting the Tenda AX-3 router's firmware. The fromAdvSetMacMtuWan function, which handles WAN configuration settings including MAC address and MTU parameters, fails to properly validate the length of user-supplied input in the serviceName2 parameter. When an attacker provides an excessively long string value for this parameter, it overwrites adjacent memory on the stack, leading to memory corruption and ultimately causing the device to crash.

Router firmware often runs with limited memory protection mechanisms, making stack overflow vulnerabilities particularly dangerous. In this case, the vulnerability can be triggered through the router's web management interface, which is typically accessible on the local network and sometimes exposed to the internet through misconfigurations.

Root Cause

The root cause of this vulnerability is improper input validation in the fromAdvSetMacMtuWan function. The function copies the serviceName2 parameter value into a fixed-size stack buffer without checking if the input length exceeds the buffer's capacity. This lack of bounds checking allows an attacker to overflow the buffer and corrupt adjacent stack memory, including potentially the function's return address.

Attack Vector

An attacker can exploit this vulnerability by sending a crafted HTTP request to the Tenda AX-3 router's web interface. The attack requires network access to the router's management interface, which is typically available on the LAN. The serviceName2 parameter must be set to a value that exceeds the expected buffer size, triggering the stack overflow condition. No authentication bypass is described, suggesting the attacker may need access to the management interface, though default or weak credentials on consumer routers are common.

The attack flow involves crafting an HTTP POST request to the fromAdvSetMacMtuWan endpoint with an oversized serviceName2 parameter value. When the router processes this request, the stack overflow occurs, corrupting memory and causing the device to crash or become unresponsive.

Detection Methods for CVE-2025-71024

Indicators of Compromise

• Unexpected router reboots or crashes, particularly during periods of no legitimate administrative activity
• HTTP requests to the router's management interface containing abnormally long parameter values (especially in the serviceName2 field)
• Network connectivity issues affecting all devices connected through the Tenda AX-3 router
• Log entries showing failed or malformed requests to the fromAdvSetMacMtuWan endpoint

Detection Strategies

• Monitor HTTP traffic to router management interfaces for requests containing unusually long parameter strings
• Implement network intrusion detection rules to identify potential buffer overflow attempts targeting Tenda router endpoints
• Configure alerts for repeated router restarts or availability issues that may indicate ongoing exploitation
• Review firewall logs for suspicious access patterns to internal router management interfaces from unauthorized sources

Monitoring Recommendations

• Enable logging on the Tenda AX-3 router if supported and regularly review for anomalies
• Deploy network monitoring to detect unexpected router downtime or connectivity interruptions
• Consider placing router management interfaces on a separate VLAN with restricted access
• Monitor for firmware update availability from Tenda and apply patches promptly when released

How to Mitigate CVE-2025-71024

Immediate Actions Required

• Restrict access to the router's web management interface to trusted IP addresses only
• Disable remote management features if enabled to prevent exploitation from external networks
• Place the router behind a firewall or network segment that limits access to the administrative interface
• Monitor the router for unexpected reboots or availability issues and investigate any anomalies
• Check for firmware updates from Tenda that may address this vulnerability

Patch Information

No official patch information is currently available from Tenda for this vulnerability. Organizations and users should monitor Tenda's official support channels for security updates. For additional technical details, refer to the GitHub Vulnerability Report.

Workarounds

• Restrict management interface access to specific trusted IP addresses using the router's access control features
• Disable WAN-side management access to prevent remote exploitation
• Consider deploying the router behind a more robust firewall appliance that can filter malicious requests
• If the router is not essential, consider replacing it with a device from a vendor with a more proactive security response
• Implement network segmentation to limit the blast radius if the router is compromised or crashes