g3 firmware vulnerabilities and fixes

Recent CVEs affecting g3 firmware, with upgrade or downgrade steps. 20 tracked.

Also searched as: g3firmware.

g3 firmware has 20 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 2. Most recent: 2025-09-09. Highest priority: CVE-2024-46628 (score 68/100).

• CVE-2025-57078 HIGH 7.5 UPGRADE Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the pppoeServerWhiteMacIndex paramet
• CVE-2025-57072 HIGH 7.5 MITIGATE Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the staticRouteGateway parameter in
• CVE-2025-57071 HIGH 7.5 MITIGATE Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the vpnUsers parameter in the formAd
• CVE-2025-57070 HIGH 7.5 MITIGATE Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the gstUp parameter in the guestWifi
• CVE-2025-57069 HIGH 7.5 MITIGATE Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the pPppUser parameter in the getsin
• CVE-2025-57064 HIGH 7.5 MITIGATE Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the bindDhcpIndex parameter in the m
• CVE-2025-57063 HIGH 7.5 MITIGATE Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the portMappingIndex parameter in th
• CVE-2025-57062 HIGH 7.5 MITIGATE Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the delDhcpIndex parameter in the fo
• CVE-2025-57061 HIGH 7.5 MITIGATE Tenda G3 v3.0br_V15.11.0.17 was discovered to contain multiple stack overflows in the formIPMacBindModify func
• CVE-2025-57060 HIGH 7.5 UPGRADE Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the rules parameter in the dns_forwa
• CVE-2025-57059 HIGH 7.5 MITIGATE Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the dhcpIndex parameter in the addDh
• CVE-2025-57058 HIGH 7.5 MITIGATE Tenda G3 v3.0br_V15.11.0.17 was discovered to contain multiple stack overflows in the formSetDebugCfg function
• CVE-2025-57057 HIGH 7.5 MITIGATE Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the listStr parameter in the ipMacBi
• CVE-2024-8225 HIGH 8.8 MITIGATE A vulnerability, which was classified as critical, was found in Tenda G3 15.11.0.20
• CVE-2024-8224 HIGH 8.8 MITIGATE A vulnerability, which was classified as critical, has been found in Tenda G3 15.11.0.20
• CVE-2024-50854 HIGH 8.8 MITIGATE Tenda G3 v3.0 v15.11.0.20 was discovered to contain a stack overflow via the formSetPortMapping function.
• CVE-2024-50853 HIGH 8.8 MITIGATE Tenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the formSetDebugCfg
• CVE-2024-50852 HIGH 8.8 MITIGATE Tenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the formSetUSBPartit
• CVE-2024-48192 HIGH 8.0 MITIGATE Tenda G3 v15.01.0.5(2848_755)_EN was discovered to contain a hardcoded password vulnerability in /etc_ro/shado
• CVE-2024-46628 CRITICAL 9.8 MITIGATE Tenda G3 Router firmware v15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability vi

FAQ

How do I fix g3 firmware vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is g3 firmware being exploited right now?

None of the tracked g3 firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which g3 firmware CVE should I patch first?

CVE-2024-46628 currently ranks highest (68/100): Tenda G3 Router firmware v15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability vi.

RSS feed for g3 firmware · ← Back to latest CVEs