cbcvebase.
CVE-2025-51087
published 2025-07-24

CVE-2025-51087: Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/saveParentControlInfo. The manipulation of the argument time leads to stack-based…

PriorityP267high8.6CVSS 3.1
AVNACLPRNUINSUCHILAL
EPSS
7.86%
94.0th percentile
Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/saveParentControlInfo. The manipulation of the argument time leads to stack-based buffer overflow.

Affected

1 ranges
VendorProductVersion rangeFixed in
tendaac8_firmware——

Detection & IOCsextracted from sources · hover to see the quote

path/goform/saveParentControlInfo↗
  • →Exploit targets HTTP POST requests to the exact URI /goform/saveParentControlInfo with a URI length of exactly 29 bytes; match on this path to identify exploitation attempts.
  • →The overflow is triggered via the 'time' parameter in the POST body; look for a 'time=' value (encoded as 'time|3d|') exceeding 100 characters before an '&' or end-of-body, indicating a buffer overflow attempt.
  • →Traffic is expected in plaintext (no TLS); deploy detection at the network perimeter and internally targeting destination IP.
  • →PoC/exploit references are tracked at github.com/TL-SN/IOT; monitor for exploit code sourced from this repository.
  • ·The Snort rule (sid:2063757) also covers CVE-2025-65223 in the same signature; analysts should be aware that a single alert may correspond to either CVE.
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.