What is the CVSS score of CVE-2025-51082?

CVE-2025-51082 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.5%.

Is there a public PoC exploit available for CVE-2025-51082?

Yes, a public proof-of-concept exploit is available for CVE-2025-51082. Prioritise patching immediately. EPSS: 0.5%.

Tenda AC8V4 CVE-2025-51082

MEDIUM

Stack-based Buffer Overflow (CWE-121)

2025-07-24 cve@mitre.org

Buffer Overflow Tenda Stack Overflow Ac8 Firmware

5.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

9.8 CRITICAL

CWE-121 stack overflow in embedded IoT firmware without memory protections enables likely RCE; PR:N confirmed by NVD vector for unauthenticated setup endpoint.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 02:30 vuln.today

DescriptionCVE.org

Tenda AC8V4 V16.03.34.06 was discovered to contain stack overflow at /goform/fast_setting_wifi_set. The manipulation of the argument timeZone` leads to stack-based buffer overflow.

AnalysisAI

Stack-based buffer overflow in Tenda AC8V4 home router firmware V16.03.34.06 exposes remote unauthenticated attackers to device crash or potential arbitrary code execution by submitting an oversized timeZone parameter to the /goform/fast_setting_wifi_set endpoint. The CVSS vector confirms no authentication is required and no user interaction is needed; a public proof-of-concept is available on GitHub. No public exploit identified at time of analysis as actively exploited by CISA KEV, but the combination of zero-authentication network access and available POC meaningfully lowers the barrier for exploitation beyond the low EPSS score of 0.47% suggests.

Technical ContextAI

The affected product is the Tenda AC8 consumer wireless router on the V4 hardware revision, running firmware version 16.03.34.06, identified by CPE cpe:2.3:o:tenda:ac8_firmware:16.03.34.06:*:*:*:*:*:*:*. The root cause is CWE-121 (Stack-based Buffer Overflow): the CGI handler for /goform/fast_setting_wifi_set accepts a timeZone parameter and copies it into a fixed-length stack buffer without validating the input length, allowing an attacker to overwrite adjacent stack memory including the saved return address. Embedded IoT firmware like Tenda's characteristically lacks modern exploit mitigations such as ASLR, stack canaries, and PIE compilation, making stack overflows significantly more exploitable for arbitrary code execution compared to hardened general-purpose operating systems.

RemediationAI

No vendor-released patch has been identified at time of analysis; no official Tenda firmware update addressing this vulnerability was found in the available references. As a primary compensating control, disable WAN-side remote management access on the router to prevent internet-exposed exploitation - this eliminates the highest-risk attack surface but does not protect against LAN-side attackers. To limit LAN-side exposure, restrict access to the router's management interface to a dedicated administrative VLAN or trusted host IP, noting this requires additional network infrastructure. If the fast setup wizard endpoint can be disabled independently in the firmware, doing so removes the vulnerable handler. Users should monitor Tenda's official support pages for a patched firmware release and apply it immediately when available.