Medium severity6.5NVD Advisory· Published Mar 4, 2025· Updated Jun 17, 2026

CVE-2025-1899

Description

A vulnerability has been found in Tenda TX3 16.03.13.11_multi and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/setPptpUserList. The manipulation of the argument list leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Affected products

Tenda/Tx3 Firmware
cpe:2.3:o:tenda:tx3_firmware:16.03.13.11:*:*:*:*:*:*:*
Tenda/TX3llm-fuzzy2 versions
16.03.13.11_multi+ 1 more
- (no CPE)range: 16.03.13.11_multi
- (no CPE)range: 16.03.13.11_multi

Patches

Vulnerability mechanics

References

github.com/2664521593/mycve/blob/main/Tenda/TX3/tenda_tx3_bof_5.pdfnvdExploit
vuldb.comnvdThird Party Advisory
vuldb.comnvdPermissions Required
vuldb.comnvdPermissions Required
www.tenda.com.cnnvdProduct

News mentions

No linked articles in our index yet.

Severity

MediumCVSS v3.1

6.5/ 10

CVSS v47.1

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

Probability of exploitation in the next 30 days.

0.71%

VYPR risk score

Composite of severity, exploitation, and reach.

0.42medium

cvss	0.423
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE ID

CVE-2025-1899

Credits

S(
shiny (VulDB User)
reporter