Login Sign Up

CVE-2025-57570

5.6 MEDIUM
Remote Code Execution Denial of Service Buffer Overflow

📋 TL;DR

This vulnerability allows attackers to execute arbitrary code or cause denial of service on Tenda F3 routers by sending specially crafted requests to the QoS configuration endpoint. It affects Tenda F3 routers running firmware version V12.01.01.48_multi and later. Attackers can exploit this remotely if the router's web interface is accessible.

💻 Affected Systems

Products:
  • Tenda F3 Wireless Router
Versions: V12.01.01.48_multi and later versions
Operating Systems: Embedded router firmware
Default Config Vulnerable: ⚠️ Yes
Notes: All default configurations are vulnerable. The web interface must be accessible for exploitation.

📦 What is this software?

F3 Firmware by Tenda

View all CVEs affecting F3 Firmware →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete router compromise, allowing attackers to intercept traffic, modify configurations, or pivot to internal networks.

🟠

Likely Case

Router crash/reboot causing temporary denial of service and potential configuration loss.

🟢

If Mitigated

No impact if the router's web interface is not exposed to untrusted networks.

🌐 Internet-Facing: HIGH if web interface exposed to internet, as exploit requires no authentication.
🏢 Internal Only: MEDIUM for internal networks, as attackers would need internal access but exploit is unauthenticated.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: MEDIUM

Exploitation requires crafting specific HTTP POST requests to the vulnerable endpoint. No authentication is required.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check Tenda website for latest firmware

Vendor Advisory: http://tenda.com

Restart Required: Yes

Instructions:

1. Log into router web interface. 2. Navigate to System Tools > Firmware Upgrade. 3. Download latest firmware from Tenda website. 4. Upload and install firmware. 5. Router will reboot automatically.

🔧 Temporary Workarounds

Disable Remote Management

all

Prevent external access to router web interface

Disable QoS Feature

all

Turn off QoS functionality if not needed

🧯 If You Can't Patch

  • Place router behind firewall with strict inbound rules
  • Use network segmentation to isolate router management interface

🔍 How to Verify

Check if Vulnerable:

Check firmware version in router web interface under System Status

Check Version:

curl -s http://router-ip/goform/getStatus | grep version

Verify Fix Applied:

Verify firmware version is newer than V12.01.01.48_multi

📡 Detection & Monitoring

Log Indicators:

  • Multiple POST requests to /goform/setQoS with large QosList parameter
  • Router reboot/crash logs

Network Indicators:

  • Unusual HTTP POST traffic to router management interface
  • Traffic patterns matching buffer overflow exploitation

SIEM Query:

source="router_logs" AND (uri="/goform/setQoS" OR message="reboot" OR message="crash")

📊 Metadata

CVE ID: CVE-2025-57570
CVSS v3 Score: 5.6 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE: CWE-120
EPSS Score: 0.03% exploit probability (9.4th percentile)
Published: September 10, 2025
Last Updated: September 17, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-57570, you might also want to check these:

CVE-2023-24482 10.0

This CVE describes a critical buffer overflow vulnerability in COMOS software's cache validation ser...

Same vulnerability type (CWE-120)
CVE-2024-22039 10.0

This vulnerability allows unauthenticated remote attackers to execute arbitrary code with root privi...

Same vulnerability type (CWE-120)
CVE-2022-22570 10.0

A buffer overflow vulnerability in UniFi Door Access Reader Lite firmware allows attackers with netw...

Same vulnerability type (CWE-120)