CVE-2025-51087
HighCVSS 8.6Exploitation Probability (EPSS)
Very high risk94th percentile - higher than 94% of all known CVEs
Summary
A stack buffer overflow vulnerability was discovered in the Tenda AC8V4 router with firmware version V16.03.34.06 in the /goform/saveParentControlInfo function. Manipulation of the time argument leads to a stack-based buffer overflow.
Risk Assessment
An attacker could remotely cause a device crash or potentially execute arbitrary code, leading to full compromise of the router and network security.
Recommendation
Immediately update the Tenda AC8V4 firmware to the latest available version if a patch is released. In the meantime, restrict access to the administrative interface to trusted networks only.
Other vulnerabilities in Tenda AC8V4
See all- CVE-2025-51089Medium
A heap overflow vulnerability was discovered in Tenda AC8V4 firmware version V16.03.34.06 in the /goform/GetParentControlInfo function. Manipulation of the mac argument leads to a heap-based buffer overflow.
- CVE-2025-51088Medium
A stack overflow vulnerability was discovered in Tenda AC8V4 firmware version V16.03.34.06 in the /goform/WifiGuestSet function. Manipulation of the shareSpeed argument leads to a stack-based buffer overflow.
- CVE-2025-51085Medium
A stack overflow vulnerability was discovered in the Tenda AC8V4 router version V16.03.34.06 in the /goform/SetSysTimeCfg function. Manipulation of the timeZone and timeType arguments can lead to a stack-based buffer overflow.
- CVE-2023-48194Critical
A vulnerability in Tenda AC8v4 firmware version V16.03.34.09 is caused by improper use of the sscanf function, which overwrites the last digit of the s8 variable with a null byte. After executing the set_client_qos command, control over the gp register can be obtained.
- CVE-2025-51082Medium
A stack overflow vulnerability was discovered in Tenda AC8V4 firmware version V16.03.34.06 in the /goform/fast_setting_wifi_set function. Manipulation of the timeZone argument leads to a stack-based buffer overflow.
- CVE-2023-39786High
A stack overflow vulnerability was discovered in the Tenda AC8V4 router firmware version V16.03.34.06. The issue occurs in the sscanf function when processing the time parameter.
- CVE-2023-39785High
A stack overflow vulnerability was discovered in the Tenda AC8V4 router firmware version V16.03.34.06 in the set_qosMib_list function via the list parameter. An attacker can remotely crash the device or potentially execute arbitrary code.
- CVE-2023-39784High
A stack overflow vulnerability was discovered in Tenda AC8V4 firmware version V16.03.34.06. The issue occurs in the save_virtualser_data function via the list parameter.
Original NVD description (English source)
Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/saveParentControlInfo. The manipulation of the argument time leads to stack-based buffer overflow.