Medium severity6.5NVD Advisory· Published Mar 4, 2025· Updated Jun 17, 2026

CVE-2025-1897

Description

A vulnerability, which was classified as critical, has been found in Tenda TX3 16.03.13.11_multi. This issue affects some unknown processing of the file /goform/SetNetControlList. The manipulation of the argument list leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products

Tenda/Tx3 Firmware
cpe:2.3:o:tenda:tx3_firmware:16.03.13.11:*:*:*:*:*:*:*
Tenda/TX3llm-fuzzy2 versions
16.03.13.11_multi+ 1 more
- (no CPE)range: 16.03.13.11_multi
- (no CPE)range: 16.03.13.11_multi

Patches

Vulnerability mechanics

References

github.com/2664521593/mycve/blob/main/Tenda/TX3/tenda_tx3_bof_3.pdfnvdExploit
vuldb.comnvdThird Party Advisory
vuldb.comnvdPermissions Required
vuldb.comnvdPermissions Required
www.tenda.com.cnnvdProduct

News mentions

No linked articles in our index yet.

Severity

MediumCVSS v3.1

6.5/ 10

CVSS v47.1

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

Probability of exploitation in the next 30 days.

1.17%

VYPR risk score

Composite of severity, exploitation, and reach.

0.42medium

cvss	0.423
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE ID

CVE-2025-1897

Credits

S(
shiny (VulDB User)
reporter