Sign-up

ID

VAR-202503-0112


CVE

CVE-2025-1896


TITLE

Shenzhen Tenda Technology Co.,Ltd.  of  tx3  Buffer error vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-002122

DESCRIPTION

A vulnerability classified as critical was found in Tenda TX3 16.03.13.11_multi. This vulnerability affects unknown code of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Shenzhen Tenda Technology Co.,Ltd. of tx3 The firmware contains a buffer error vulnerability and a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. The vulnerability is caused by the parameter list of goform /setstaticRoutecfg failing to correctly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code or cause a denial of service

Trust: 2.16

sources: NVD: CVE-2025-1896 // JVNDB: JVNDB-2025-002122 // CNVD: CNVD-2025-05399

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-05399

AFFECTED PRODUCTS

vendor:tendamodel:tx3scope:eqversion:16.03.13.11

Trust: 1.0

vendor:tendamodel:tx3scope:eqversion: -

Trust: 0.8

vendor:tendamodel:tx3scope: - version: -

Trust: 0.8

vendor:tendamodel:tx3scope:eqversion:tx3 firmware 16.03.13.11

Trust: 0.8

vendor:tendamodel:tx3 16.03.13.11 multiscope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2025-05399 // JVNDB: JVNDB-2025-002122 // NVD: CVE-2025-1896

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2025-1896
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2025-1896
value: HIGH

Trust: 1.0

OTHER: JVNDB-2025-002122
value: HIGH

Trust: 0.8

CNVD: CNVD-2025-05399
value: MEDIUM

Trust: 0.6

cna@vuldb.com: CVE-2025-1896
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:L/AU:S/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

OTHER: JVNDB-2025-002122
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:L/AU:S/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2025-05399
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:L/AU:S/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2025-1896
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 3.6
version: 3.1

Trust: 1.0

nvd@nist.gov: CVE-2025-1896
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: JVNDB-2025-002122
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2025-05399 // JVNDB: JVNDB-2025-002122 // NVD: CVE-2025-1896 // NVD: CVE-2025-1896

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.0

problemtype:CWE-120

Trust: 1.0

problemtype:Buffer error (CWE-119) [ others ]

Trust: 0.8

problemtype: Classic buffer overflow (CWE-120) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2025-002122 // NVD: CVE-2025-1896

EXTERNAL IDS

db:NVDid:CVE-2025-1896

Trust: 3.2

db:VULDBid:298414

Trust: 1.0

db:JVNDBid:JVNDB-2025-002122

Trust: 0.8

db:CNVDid:CNVD-2025-05399

Trust: 0.6

sources: CNVD: CNVD-2025-05399 // JVNDB: JVNDB-2025-002122 // NVD: CVE-2025-1896

REFERENCES

url:https://github.com/2664521593/mycve/blob/main/tenda/tx3/tenda_tx3_bof_2.pdf

Trust: 1.8

url:https://vuldb.com/?submit.506602

Trust: 1.8

url:https://www.tenda.com.cn/

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2025-1896

Trust: 1.4

url:https://vuldb.com/?ctiid.298414

Trust: 1.0

url:https://vuldb.com/?id.298414

Trust: 1.0

sources: CNVD: CNVD-2025-05399 // JVNDB: JVNDB-2025-002122 // NVD: CVE-2025-1896

SOURCES

db:CNVDid:CNVD-2025-05399
db:JVNDBid:JVNDB-2025-002122
db:NVDid:CVE-2025-1896

LAST UPDATE DATE

2025-03-20T23:06:34.839000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-05399date:2025-03-19T00:00:00
db:JVNDBid:JVNDB-2025-002122date:2025-03-06T12:11:00
db:NVDid:CVE-2025-1896date:2025-03-05T16:39:15.917

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-05399date:2025-03-19T00:00:00
db:JVNDBid:JVNDB-2025-002122date:2025-03-06T00:00:00
db:NVDid:CVE-2025-1896date:2025-03-04T02:15:36.340