CVE-2025-57572 identifies a buffer overflow vulnerability (CWE-120) in Tenda F3 router firmware starting from version V12.01.01.48_multi and later. The flaw exists in the processing of the onlineList parameter in the goform/setParentControl functionality, which could lead to memory corruption. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable over the network without privileges or user interaction but requires high attack complexity. The impact includes limited confidentiality, integrity, and availability loss. No vendor advisory or patch information is currently available.

Successful exploitation of this buffer overflow vulnerability could allow an unauthenticated remote attacker to cause limited confidentiality, integrity, and availability impacts on the affected device. The medium CVSS score reflects that exploitation is possible but requires high attack complexity, and the impact is limited in scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected device's management interface to trusted networks only and monitor for unusual activity related to the goform/setParentControl endpoint. Avoid exposing the device management interface to untrusted networks.