CVE-2026-4254: A weakness has been identified in Tenda AC8 up to 16.03.50.11. This vulnerability affects the function doSystemCmd of the file /goform/SysToolChangePwd of the…

PriorityP268critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.89%

55.5th percentile

A weakness has been identified in Tenda AC8 up to 16.03.50.11. This vulnerability affects the function doSystemCmd of the file /goform/SysToolChangePwd of the component HTTP Endpoint. This manipulation of the argument local_2c causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
tenda	ac8	—	—
tenda	ac8	—	—
tenda	ac8	—	—
tenda	ac8	—	—
tenda	ac8	—	—
tenda	ac8	—	—
tenda	ac8	—	—
tenda	ac8	—	—
tenda	ac8	—	—
tenda	ac8	—	—
tenda	ac8	—	—
tenda	ac8	—	—
tenda	ac8_firmware	<= 16.03.50.11	—

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv4.08.9HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.