CVE-2023-39785
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A stack overflow vulnerability was discovered in the Tenda AC8V4 router firmware version V16.03.34.06 in the set_qosMib_list function via the list parameter. An attacker can remotely crash the device or potentially execute arbitrary code.
Risk Assessment
The risk includes potential remote takeover of the router, leading to network compromise, traffic interception, or use of the device in DDoS attacks.
Recommendation
Immediately update the Tenda AC8V4 firmware to the latest version available from the vendor. If no update is available, restrict management interface access to trusted networks only.
Other vulnerabilities in Tenda AC8V4
See all- CVE-2025-51089Medium
A heap overflow vulnerability was discovered in Tenda AC8V4 firmware version V16.03.34.06 in the /goform/GetParentControlInfo function. Manipulation of the mac argument leads to a heap-based buffer overflow.
- CVE-2025-51088Medium
A stack overflow vulnerability was discovered in Tenda AC8V4 firmware version V16.03.34.06 in the /goform/WifiGuestSet function. Manipulation of the shareSpeed argument leads to a stack-based buffer overflow.
- CVE-2025-51087High
A stack buffer overflow vulnerability was discovered in the Tenda AC8V4 router with firmware version V16.03.34.06 in the /goform/saveParentControlInfo function. Manipulation of the time argument leads to a stack-based buffer overflow.
- CVE-2025-51085Medium
A stack overflow vulnerability was discovered in the Tenda AC8V4 router version V16.03.34.06 in the /goform/SetSysTimeCfg function. Manipulation of the timeZone and timeType arguments can lead to a stack-based buffer overflow.
- CVE-2023-48194Critical
A vulnerability in Tenda AC8v4 firmware version V16.03.34.09 is caused by improper use of the sscanf function, which overwrites the last digit of the s8 variable with a null byte. After executing the set_client_qos command, control over the gp register can be obtained.
- CVE-2025-51082Medium
A stack overflow vulnerability was discovered in Tenda AC8V4 firmware version V16.03.34.06 in the /goform/fast_setting_wifi_set function. Manipulation of the timeZone argument leads to a stack-based buffer overflow.
- CVE-2023-39786High
A stack overflow vulnerability was discovered in the Tenda AC8V4 router firmware version V16.03.34.06. The issue occurs in the sscanf function when processing the time parameter.
- CVE-2023-39784High
A stack overflow vulnerability was discovered in Tenda AC8V4 firmware version V16.03.34.06. The issue occurs in the save_virtualser_data function via the list parameter.
Original NVD description (English source)
Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the list parameter in the set_qosMib_list function.