PT-2026-3945 · Tenda · Tenda Ax3

Published 2026-01-22 · Updated 2026-01-22 · CVE-2025-69764

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda AX3 firmware version 16.03.12.11

Description The software contains a stack-based buffer overflow in the formGetIptv function. This is due to improper handling of the stbpvid stack buffer, which may lead to memory corruption and remote code execution.

Recommendations Update to a newer version of the firmware to address this issue. As a temporary workaround, consider disabling the formGetIptv function until a patch is available.

Exploit

Fix

RCE

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2025-69764

Affected Products

Tenda Ax3

References · 7

• 🔥 https://river-brow-763.notion.site/Tenda-AX3-Buffer-Overflow-in-formGetIptv-2c9a595a7aef80e9b90fdaa56f51374b?source=copy_link · Exploit
• 🔥 https://river-brow-763.notion.site/Tenda-AX3-Buffer-Overflow-in-formGetIptv-2c9a595a7aef80e9b90fdaa56f51374b · Exploit
• https://osv.dev/vulnerability/CVE-2025-69764 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69764 · Security Note
• https://twitter.com/lsof/status/2014399599180447888 · Twitter Post
• https://twitter.com/CVEnew/status/2014366270087365085 · Twitter Post
• https://twitter.com/CveFindCom/status/2014377288993751392 · Twitter Post