Tenda Ac8 Firmware vulnerabilities

CVE-2025-25668 [CRITICAL] CWE-120 CVE-2025-25668: Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the sub_47D878 function.

CVE-2025-4368 [CRITICAL] CWE-119 CVE-2025-4368: A vulnerability, which was classified as critical, was found in Tenda AC8 16.03.34.06. Affected is t A vulnerability, which was classified as critical, was found in Tenda AC8 16.03.34.06. Affected is the function formGetRouterStatus of the file /goform/MtuSetMacWan. The manipulation of the argument shareSpeed leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-25667 [CRITICAL] CWE-120 CVE-2025-25667: Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the urls parameter in the fu Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the urls parameter in the function get_parentControl_list_Info.

CVE-2025-25663 [CRITICAL] CWE-787 CVE-2025-25663: A vulnerability was found in Tenda AC8V4 V16.03.34.06. Affected is the function SUB_0046AC38 of the A vulnerability was found in Tenda AC8V4 V16.03.34.06. Affected is the function SUB_0046AC38 of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to stack-based buffer overflow.

CVE-2024-57703 [CRITICAL] CWE-787 CVE-2024-57703: Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability. Affected by this vulnerability is the f Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability. Affected by this vulnerability is the function setSchedWifi of the file /goform/openSchedWifi. The manipulation of the argument schedEndTime leads to stack-based buffer overflow.

CVE-2023-33675 [CRITICAL] CWE-787 CVE-2023-33675: Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the get_parentControl_list_Info function.

CVE-2023-33673 [CRITICAL] CWE-787 CVE-2023-33673: Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the firewallEn parameter i Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function.

CVE-2023-33671 [CRITICAL] CWE-787 CVE-2023-33671: Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the deviceId parameter in Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the deviceId parameter in the saveParentControlInfo function.

CVE-2023-40899 [CRITICAL] CWE-787 CVE-2023-40899: Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter m Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList at /goform/setMacFilterCfg.

CVE-2023-33670 [CRITICAL] CWE-787 CVE-2023-33670: Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the sub_4a79ec function.

CVE-2023-40896 [CRITICAL] CWE-787 CVE-2023-40896: Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter l Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list and bindnum at /goform/SetIpMacBind.

CVE-2023-40893 [CRITICAL] CWE-787 CVE-2023-40893: Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter t Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter time at /goform/PowerSaveSet.

CVE-2024-46652 [CRITICAL] CWE-787 CVE-2024-46652: Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability in the fromAdvSetMacMtuWan function. Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability in the fromAdvSetMacMtuWan function.

CVE-2025-0528 [HIGH] CWE-74 CVE-2025-0528: A vulnerability, which was classified as critical, has been found in Tenda AC8, AC10 and AC18 16.03. A vulnerability, which was classified as critical, has been found in Tenda AC8, AC10 and AC18 16.03.10.20. Affected by this issue is some unknown functionality of the file /goform/telnet of the component HTTP Request Handler. The manipulation leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and

CVE-2024-57704 [HIGH] CWE-787 CVE-2024-57704: Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability. Affected by this vulnerability is the f Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability. Affected by this vulnerability is the function setSchedWifi of the file /goform/openSchedWifi. The manipulation of the argument schedStartTime leads to stack-based buffer overflow.

CVE-2023-40895 [CRITICAL] CWE-787 CVE-2023-40895: Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter l Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list at /goform/SetVirtualServerCfg.

CVE-2023-40900 [CRITICAL] CWE-787 CVE-2023-40900: Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter l Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list at /goform/SetNetControlList.

CVE-2023-40897 [CRITICAL] CWE-787 CVE-2023-40897: Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter m Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter mac at /goform/GetParentControlInfo.

CVE-2023-40898 [CRITICAL] CWE-787 CVE-2023-40898: Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter t Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter timeZone at /goform/SetSysTimeCfg.

CVE-2023-40894 [CRITICAL] CWE-787 CVE-2023-40894: Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter l Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list at /goform/SetStaticRouteCfg.