CVE-2026-2203 — Improper Restriction of Operations within the Bounds of a Memory Buffer in AC8

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120 — Classic Buffer Overflow3 documents3 sources

Severity

7.4HIGHNVD

EPSS

0.1%

top 73.41%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Tenda AC8 Tenda AC8 Firmware

Timeline

PublishedFeb 9

Description

A flaw has been found in Tenda AC8 16.03.33.05. Affected by this vulnerability is an unknown functionality of the file /goform/fast_setting_wifi_set of the component Embedded Httpd Service. This manipulation of the argument timeZone causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5tenda/ac816.03.33.05

▶NVDtenda/ac8_firmware16.03.33.05

🔴Vulnerability Details

GHSA

GHSA-527g-r3hr-w3j8: A flaw has been found in Tenda AC8 16↗2026-02-09

▶

CVEList

Tenda AC8 Embedded Httpd Service fast_setting_wifi_set buffer overflow↗2026-02-09

▶