CVE-2025-29357 Denial of service in n/a
Attackers can cause a denial of service on Tenda RX3 routers by sending crafted packets to the PPTP server configuration endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-29357?
CVE-2025-29357 is a high-severity denial of service vulnerability in n/a, published on 13 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the startIp and endIp parameters at /goform/SetPptpServerCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Weakness: CWE-404
Which versions are affected by CVE-2025-29357?
It affects 1 product.
Products include Tenda Rx3 Firmware.
How do I fix CVE-2025-29357?
No fix has been published for CVE-2025-29357 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-29357 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-29357 exists.
Other vulnerabilities in n/a
- CVE-2025-44899 Memory corruption in n/a
- CVE-2026-2180 Tenda RX3 fast_setting_wifi_set stack-based overflow
- CVE-2026-2181 Tenda RX3 openSchedWifi stack-based overflow
- CVE-2026-2185 Tenda RX3 MAC Filtering Configuration Endpoint setBlackRule set_device_name stack-based overflow
- CVE-2026-2186 Tenda RX3 SetIpMacBind fromSetIpMacBind stack-based overflow
Sources
Also known as GHSA-p487-32h6-758c.