CVE-2025-12618
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
Tenda AC8 16.03.34.06 has a vulnerability in an unknown function of /goform/DatabaseIniSet. Manipulation of the Time argument leads to a buffer overflow, and the attack can be initiated remotely. The exploit has been publicly disclosed and may be used.
Risk Assessment
A remote attacker could exploit the buffer overflow to execute arbitrary code or cause a denial of service. Public availability of the exploit increases the risk.
Recommendation
Update Tenda AC8 firmware to the latest version if available. Otherwise, restrict management interface access and monitor network traffic.
Other vulnerabilities in Tenda AC8
See all- CVE-2023-4744Critical
A critical vulnerability was found in Tenda AC8 version 16.03.34.06_cn_TDC01 in the formSetDeviceName function, leading to stack-based buffer overflow. The vulnerability can be exploited remotely.
- CVE-2023-40894Critical
The Tenda AC8 v4 device has a stack overflow vulnerability due to improper handling of the parameter list at the endpoint /goform/SetStaticRouteCfg.
- CVE-2025-61498High
A buffer overflow vulnerability in the UPnP service of Tenda AC8 hardware version v03.03.10.01 allows an attacker to cause a Denial of Service (DoS) by sending a crafted packet.
- CVE-2025-11120High
A weakness has been identified in Tenda AC8 16.03.34.06. The affected element is the function formSetServerConfig of the file /goform/SetServerConfig. Executing manipulation can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.
- CVE-2025-52054Medium
In the Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router with firmware 16.03.33.05, the root password is calculated from a static string and the last two octets of the device MAC address. This allows an unauthenticated attacker to authenticate with network services on the device.
Original NVD description (English source)
A vulnerability has been found in Tenda AC8 16.03.34.06. This impacts an unknown function of the file /goform/DatabaseIniSet. The manipulation of the argument Time leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS