CVE-2025-65223: n/a
Source CVE Database V5
Not known to be exploited · CVSS 4.3 Medium.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 24% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 20 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
AI-suggested
1. Immediately restrict access to the router’s management interface, especially the /goform/saveParentControlInfo endpoint, by implementing network segmentation and firewall rules limiting access to trusted devices only. 2. Monitor Tenda’s official channels for firmware updates addressing this vulnerability and apply patches promptly once available. 3. Employ network intrusion detection systems (NIDS) to detect anomalous HTTP requests targeting the vulnerable endpoint or unusual traffic patterns indicative of exploitation attempts. 4. For organizations with multiple Tenda AC21 devices, consider replacing affected routers with models from vendors with stronger security track records or those that provide timely security updates. 5. Educate users about the risks of exposing router management interfaces to untrusted networks, including Wi-Fi guest networks or the internet. 6. Regularly audit network devices for firmware versions and known vulnerabilities to maintain an up-to-date inventory and risk profile.
Description
CVE-2025-65223 is a medium severity buffer overflow vulnerability found in the Tenda AC21 router firmware version V16.03.08.16. The flaw exists in the /goform/saveParentControlInfo endpoint, specifically in the handling of the 'urls' parameter. Exploitation requires network-level access (adjacent network) but no authentication or user interaction is needed. Successful exploitation can cause denial of service by crashing the device, impacting availability but not confidentiality or integrity. No known exploits are currently reported in the wild. European organizations using Tenda AC21 routers may experience network disruptions if targeted. Mitigation involves monitoring for firmware updates from Tenda and restricting access to router management interfaces.