Tenda AX3 Buffer Overflow

Tenda AX3 is a networking device used for managing IPTV services. The vulnerability in Tenda AX3 v16.03.12.11 allows attackers to execute arbitrary code on the device by sending a malicious string via the iptvType parameter, potentially leading to remote code execution (RCE) and memory corruption.

Specific version info not stated in the advisory. If you don't recognise this software, you're probably not affected.

1. Upgrade to Tenda AX3 version 16.03.12.12 or later from the official Tenda website.
2. Immediate mitigations:
3. Restrict network access to your Tenda AX3 instance (firewall it from the public internet)
4. Audit iptvType parameter usage for suspicious patterns

• Exploit