CVE-2025-4357 is a medium severity (CVSS 4.7) command injection flaw in the Tenda RX3 router, firmware 16.03.13.11_multi, in the /goform/telnet handler. The record says the exploit is public and names no fix, so limit access to the admin interface and check Tenda's support site for newer firmware.
What's affected
The record lists Tenda RX3 firmware 16.03.13.11_multi. The affected component is the file /goform/telnet, and the description says the attack may be initiated remotely and that the exploit has been disclosed to the public and may be used.
The record names no fixed version, and I could not confirm one from a vendor advisory. Check Tenda's support pages for firmware newer than 16.03.13.11_multi.
The vector shows high privileges required, which is the main reason the score sits at 4.7 even though the description calls the flaw critical. The title of this post follows the record's score, so this is a medium rating.
How to check if you're exposed
Log in to the router admin page and find the firmware version in the system status or upgrade screen. The value 16.03.13.11_multi matches the record.
The vector requires a high privileged account, so look at the admin accounts. Confirm the password is not a default, not shared, and not reused elsewhere, and check whether more than one admin account exists.
Also confirm that remote management is off and that the admin page is not reachable from guest Wi-Fi. If you run many sites, list RX3 units from your inventory.
What to do now
- Locate each Tenda RX3 and note its firmware.
- Check the Tenda support site for a newer build and apply it if available.
- Change the admin password to a strong, unique value and remove any extra admin accounts.
- Turn off remote management and any telnet or shell service you do not need.
- Keep the admin page off guest and internet facing networks.
- Plan replacement if no update arrives and the device is in a sensitive location.
Why it matters
The class is injection, CWE-74 (Injection) and CWE-77 (Command Injection). Input reaches a command run by the router without its special characters being neutralised. The handler named in the record, /goform/telnet, relates to the device's telnet feature, which is a sensible place to expect careful checking, since the function exists to run privileged operations.
The medium score reflects a real constraint. An attacker needs a high privileged account before the flaw can be used. That makes it less urgent than an anonymous bug, but it does mean a stolen or guessed admin password can be turned into control of the underlying system, which is worse than the web admin alone.
The record says a public exploit exists. It does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. For consumer and small office routers, strong admin credentials and closed remote access remove most of the practical risk.
Quick check
Why is this only medium when the description says critical?
The description uses the original reporter's wording. The CVSS vector in the record requires high privileges, which gives a score of 4.7 and a medium rating.
What is the quickest mitigation?
Use a strong, unique admin password, keep remote management off and keep the admin page away from guest networks.
Sources
- Gold entry for CVE-2025-4357
- Public write-up referenced by the NVD record
- VulDB entry 307475 referenced by the NVD record
- Tenda site referenced by the NVD record
Last reviewed: 18 October 2026.
