CVE-2025-57570 is a buffer overflow vulnerability affecting Tenda F3 routers running firmware version 12.01.01.48 and later. The flaw exists in the processing of the QosList parameter in the goform/setQoS interface, which may allow an attacker to cause a buffer overflow condition. The CVSS v3.1 base score is 5.6, indicating a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. There is no known exploit in the wild and no vendor patch or advisory currently available.

Successful exploitation of this buffer overflow vulnerability could allow an unauthenticated remote attacker to cause limited information disclosure, data modification, or denial of service on affected Tenda F3 devices. The medium CVSS score reflects moderate impact with high attack complexity and no privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device and avoid sending untrusted input to the goform/setQoS endpoint.