CVE-2023-51812 is a command injection in the Tenda AX3 router, firmware 16.03.12.11. The list parameter of the /goform/SetNetControlList endpoint allows remote code execution. The record rates it Critical at 9.8. No fixed firmware is named, so check Tenda's support site.
What's affected
The record names Tenda AX3 firmware 16.03.12.11. It does not list a fixed version, and the only reference is a public issue report, so we cannot name a patch. Check Tenda's support site for newer firmware for the AX3.
The record gives a CVSS score of 9.8 (Critical). The CVSS vector reads as follows. The attack can be reached over the network, and the complexity is low. No account is needed. No user interaction is required. Impact on confidentiality is high, on integrity high, and on availability high. The weakness class is CWE-77.
How to check if you're exposed
Open the router's web interface from a trusted internal machine and read the firmware version on the system status page. If it is 16.03.12.11, you are on the named version.
Check that the management interface is not reachable from the internet. Use your router's remote management setting and, if you can, an outside port check.
What to do now
- Find AX3 routers in your estate and read their firmware versions.
- Look for newer firmware from Tenda and install it.
- Disable remote management from the internet side.
- Change the administrator password to a strong, unique one.
- If no fix exists, plan to replace the router, since a remote code execution flaw on an edge device is a serious risk.
Why it matters
Command injection, CWE-77, means input from a request reaches a shell command without proper cleaning. The record names the list parameter of one endpoint. The router runs the injected text with its own privileges, which on consumer routers are usually the highest.
The 9.8 score reflects no authentication, network access and full impact. Router firmware often cannot be inspected by its owner, which is why vendor patching matters so much.
Consumer and small office routers rarely show a patch notice to their owners, so the version check above is the step most often skipped. Edge devices are attractive because they sit between a network and the internet and see everything. Fixing the firmware, or retiring the device, is the only complete answer.
One practical note for small offices: a router like this is often installed once and never revisited. Put its firmware version in the same inventory as your laptops and servers, with a date for the next review, so a CVE like this one can be answered by looking something up instead of walking to the closet.
Quick check
Is there a patch?
Not named in the record. Check Tenda's support site for AX3 firmware.
Does the attacker need to log in?
The vector shows no privileges required.
Sources
Last reviewed: 19 October 2026.
