CVE-2025-69766

Critical · 9.8

CVSS

9.8

EPSS

0.8%

Published

Jan 21, 2026

CISA due date

—

The record

Tenda AX3 firmware v16.03.12.11 contains a stack-based buffer overflow in the formGetIptv function due to improper handling of the citytag stack buffer, which may result in memory corruption and remote code execution.

Affected packages

Ecosystem	Package	Introduced	Fixed