CVE-2025-63454: High severity Tenda AX-3 vulnerability

Published Oct 31, 2025

Updated

Tenda AX-3 v16.03.12.10CN was discovered to contain a stack overflow via the deviceId parameter in the getparentControllistInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

Affected Software

3 affected components

Tenda AX-3

All of the following

Tenda AX3 firmware=16.03.12.10_cn

Tenda AX3

Event History

Oct 31, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-63454?

CVE-2025-63454 is categorized as a high severity vulnerability due to its potential to cause Denial of Service.

How do I fix CVE-2025-63454?

Fixing CVE-2025-63454 involves updating the Tenda AX-3 device firmware to the latest version provided by the manufacturer.

What type of attack is possible with CVE-2025-63454?

CVE-2025-63454 allows attackers to execute a Denial of Service (DoS) attack through a crafted request.

Which devices are affected by CVE-2025-63454?

The Tenda AX-3 device running firmware v16.03.12.10_CN is affected by CVE-2025-63454.

What is the cause of CVE-2025-63454?

CVE-2025-63454 is caused by a stack overflow in the get_parentControl_list_Info function due to improper handling of the deviceId parameter.