What is the CVSS score of CVE-2025-51085?

CVE-2025-51085 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 6.8%.

Is there a public PoC exploit available for CVE-2025-51085?

Yes, a public proof-of-concept exploit is available for CVE-2025-51085. Prioritise patching immediately. EPSS: 6.8%.

Tenda AC8 CVE-2025-51085

MEDIUM

Stack-based Buffer Overflow (CWE-121)

2025-07-24 cve@mitre.org

Buffer Overflow Tenda Stack Overflow Ac8 Firmware

5.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

7.5 HIGH

Network-reachable, no auth, no interaction; stack overflow in consumer router firmware reliably causes full device crash, warranting A:H over A:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 03:45 vuln.today

DescriptionCVE.org

Tenda AC8V4 V16.03.34.06 was discovered to contain stack overflow at /goform/SetSysTimeCfg. The manipulation of the argument timeZone and timeType` leads to stack-based buffer overflow.

AnalysisAI

Stack-based buffer overflow in Tenda AC8V4 firmware version 16.03.34.06 allows unauthenticated remote attackers to crash the device by sending a crafted HTTP request to the /goform/SetSysTimeCfg endpoint with oversized timeZone or timeType parameters. The vulnerability requires no authentication or user interaction per the CVSS:3.1 vector (PR:N/UI:N), making it trivially exploitable against any network-accessible management interface. A publicly available proof-of-concept exists on GitHub, and the EPSS score of 6.77% at the 93rd percentile signals meaningfully elevated exploitation probability relative to most CVEs - no public exploit identified at time of analysis as confirmed by CISA KEV, but POC availability lowers the bar for less-skilled actors.

Technical ContextAI

The affected product is Tenda AC8V4 running firmware version 16.03.34.06, identified via CPE cpe:2.3:o:tenda:ac8_firmware:16.03.34.06:*:*:*:*:*:*:*. The AC8 is a home/SOHO wireless router whose embedded web server exposes CGI form handlers under the /goform/ path. The SetSysTimeCfg handler processes time configuration submissions, accepting user-supplied values for timeZone and timeType parameters. CWE-121 (Stack-Based Buffer Overflow) indicates the root cause: the handler copies user-controlled input into a fixed-size stack buffer without adequate length validation, allowing an attacker to write beyond the buffer boundary. On MIPS or ARM-based embedded firmware - common in Tenda devices - this class of flaw can corrupt the saved return address or frame pointer on the stack, potentially enabling arbitrary code execution beyond the stated DoS impact, depending on the presence of mitigations such as stack canaries or ASLR (which are frequently absent in consumer router firmware).

RemediationAI

No vendor-released patch has been identified at time of analysis - Tenda has not published an advisory or fixed firmware version in the available reference data. As a primary compensating control, restrict access to the router's web management interface (typically port 80/443) to trusted LAN segments only and explicitly disable remote management (WAN-side access) if it has been enabled - this eliminates the network attack surface entirely at the cost of requiring physical or LAN access for administration. Additionally, place the device behind a firewall that blocks inbound HTTP/HTTPS to the management port from untrusted networks. Monitor Tenda's firmware release page for a patched version and apply it immediately upon availability. Users should check https://github.com/TL-SN/IOT/blob/main/Tenda/Tenda-AC8v4%20%20V16.03.34.06/CVE-2025-51085.md for researcher-published details that may inform additional mitigations.