Tenda AC8V4 CVE-2025-51082

No authentication is required - the CVSS vector PR:N confirms the /goform/fast_setting_wifi_set endpoint is reachable without credentials, which is consistent with a Wi-Fi quick-setup handler intended to be accessible pre-authentication during initial device configuration. The attacker must have network-level access to the router's HTTP management interface: for most home deployments this means LAN-side access, but Tenda devices with WAN remote management enabled would be exploitable directly from the internet. No special non-default configuration is required beyond a standard firmware deployment on the affected version. Exploitation is constrained by: (1) network adjacency - LAN access required unless WAN management is explicitly enabled by the user; (2) exact firmware version V16.03.34.06 is the only version confirmed vulnerable per available CPE data; (3) physical or logical network access to the router is a prerequisite regardless of WAN management state.

The NVD CVSS score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L reflects only confirmed availability impact, which is likely conservative for a CWE-121 stack overflow in embedded IoT firmware. The zero-authentication network attack vector (PR:N, AV:N, AC:L) represents a serious risk factor: no privileges or user interaction are needed, and exploitation conditions are straightforward. EPSS at 0.47% (37th percentile) indicates limited automated exploitation observed to date, which is common for IoT CVEs that attract targeted rather than widespread scanning activity. A public POC tagged as an exploit by NVD exists on GitHub, further lowering the exploitation bar. CISA KEV status is not confirmed, so active exploitation in the wild is not confirmed. The key analytical tension is the NVD's conservative C:N/I:N impact rating versus the vulnerability class - stack overflows in embedded firmware without memory protections routinely enable full RCE, suggesting real-world impact likely exceeds the CVSS score. This discrepancy should be verified against the POC's demonstrated behavior.

An unauthenticated attacker with network access to the router's web management interface sends a crafted HTTP POST request to /goform/fast_setting_wifi_set containing a timeZone parameter value that exceeds the fixed stack buffer size. With no input length validation, the overflow corrupts the stack frame and overwrites the return address; on typical embedded firmware lacking stack canaries or ASLR, this enables reliable control-flow hijacking. A public POC demonstrating this is available on GitHub, confirming the vulnerability is practically reproducible.