CVE-2025-51089
MediumCVSS 6.5Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
A heap overflow vulnerability was discovered in Tenda AC8V4 firmware version V16.03.34.06 in the /goform/GetParentControlInfo function. Manipulation of the mac argument leads to a heap-based buffer overflow.
Risk Assessment
An attacker could remotely crash the device or potentially execute arbitrary code, threatening network stability and security.
Recommendation
Immediately update the firmware to the latest version available from the vendor and restrict access to the administration panel to trusted networks only.
Other vulnerabilities in Tenda AC8V4
See all- CVE-2025-51088Medium
A stack overflow vulnerability was discovered in Tenda AC8V4 firmware version V16.03.34.06 in the /goform/WifiGuestSet function. Manipulation of the shareSpeed argument leads to a stack-based buffer overflow.
- CVE-2025-51087High
A stack buffer overflow vulnerability was discovered in the Tenda AC8V4 router with firmware version V16.03.34.06 in the /goform/saveParentControlInfo function. Manipulation of the time argument leads to a stack-based buffer overflow.
- CVE-2025-51085Medium
A stack overflow vulnerability was discovered in the Tenda AC8V4 router version V16.03.34.06 in the /goform/SetSysTimeCfg function. Manipulation of the timeZone and timeType arguments can lead to a stack-based buffer overflow.
- CVE-2023-48194Critical
A vulnerability in Tenda AC8v4 firmware version V16.03.34.09 is caused by improper use of the sscanf function, which overwrites the last digit of the s8 variable with a null byte. After executing the set_client_qos command, control over the gp register can be obtained.
- CVE-2025-51082Medium
A stack overflow vulnerability was discovered in Tenda AC8V4 firmware version V16.03.34.06 in the /goform/fast_setting_wifi_set function. Manipulation of the timeZone argument leads to a stack-based buffer overflow.
- CVE-2023-39786High
A stack overflow vulnerability was discovered in the Tenda AC8V4 router firmware version V16.03.34.06. The issue occurs in the sscanf function when processing the time parameter.
- CVE-2023-39785High
A stack overflow vulnerability was discovered in the Tenda AC8V4 router firmware version V16.03.34.06 in the set_qosMib_list function via the list parameter. An attacker can remotely crash the device or potentially execute arbitrary code.
- CVE-2023-39784High
A stack overflow vulnerability was discovered in Tenda AC8V4 firmware version V16.03.34.06. The issue occurs in the save_virtualser_data function via the list parameter.
Original NVD description (English source)
Tenda AC8V4 V16.03.34.06` was discovered to contain heap overflow at /goform/GetParentControlInfo.The manipulation of the argument `mac` leads to heap-based buffer overflow.