CVE-2025-3167: Tenda AC23 API Interface VerAPIMant denial of service

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-04-03 · updated 2026-06-17
Weakness: CWE-404

Description

A vulnerability, which was classified as problematic, has been found in Tenda AC23 16.03.07.52. This issue affects some unknown processing of the file /goform/VerAPIMant of the component API Interface. The manipulation of the argument getuid leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products

Tenda AC23: 16.03.07.52

References

https://github.com/LZY0522/CVE/blob/main/CVE_1.md
https://vuldb.com/?ctiid.303113
https://vuldb.com/?id.303113
https://vuldb.com/?submit.543150
https://www.tenda.com.cn/
https://github.com/LZY0522/CVE/blob/main/CVE_1.md

Get alerted when CVE-2025-3167 or the next vulnerability affects your stack