Buffer overflow in Tenda Ac8
CVE-2025-4368
A vulnerability, which was classified as critical, was found in Tenda AC8 16.03.34.06. Affected is the function formGetRouterStatus of the file /goform/MtuSetMacWan. The manipulation of the argument shareSpeed leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Vulnerability class: Buffer Overflow
EPSS: 0.008 (51.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Tenda Ac8 — versions 16.03.34.06
- Tenda Ac8_firmware — versions 16.03.34.06
Weakness classification (CWE)
References
- cna@vuldb.com (technical-description, VDB Entry, Third Party Advisory, vdb-entry)
- cna@vuldb.com (signature, Permissions Required, permissions-required, VDB Entry)
- cna@vuldb.com (VDB Entry, Third Party Advisory, third-party-advisory)
- cna@vuldb.com (exploit, broken-link, Broken Link)
- cna@vuldb.com (Product, product)
Frequently asked questions
- What is CVE-2025-4368?
- CVE-2025-4368 is a high-severity vulnerability in Tenda Ac8, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 8.8/10. Published 2025-05-06.
- How severe is CVE-2025-4368?
- High severity. CVSS v3 base score is 8.8 out of 10.