Tenda AC8 CVE-2025-51085

The attacker must be able to reach the Tenda AC8V4 router's HTTP web management interface over the network - confirmed by CVSS AV:N. No authentication is required (CVSS PR:N) and no user interaction is needed (CVSS UI:N). The specific endpoint /goform/SetSysTimeCfg must be reachable, which it is by default on devices with the management interface active. Exploitation is limited if the management interface is bound only to the LAN interface (the more common default), meaning WAN-facing exploitation requires either remote management to be explicitly enabled or the attacker to already have LAN access. The exact firmware version 16.03.34.06 is confirmed vulnerable; whether neighboring versions are affected is unknown. No special non-default configuration is otherwise required beyond network reachability to the management port.

The NVD-assigned CVSS score of 5.3 (Medium) reflects only the demonstrated availability impact (A:L), scoring C:N and I:N. However, this likely understates actual risk: stack-based buffer overflows in consumer router firmware (CWE-121) commonly allow full arbitrary code execution when canaries and ASLR are absent, which is typical for embedded MIPS/ARM devices in this class. The EPSS score of 6.77% at the 93rd percentile - meaning this CVE ranks in the top 7% for exploitation likelihood - is a strong signal that threat actors are paying attention, particularly given the publicly available POC on GitHub. KEV status is not confirmed, so active mass exploitation is not confirmed but cannot be ruled out. The CVSS attack vector AV:N/AC:L/PR:N/UI:N confirms the vulnerability is reachable over the network without credentials and requires no interaction - the lowest-barrier exploitation profile. The primary limiting factor is whether the router's management interface is exposed to WAN (many Tenda routers default to LAN-only management, which contains blast radius). Overall, this should be treated as higher priority than CVSS 5.3 implies, especially for internet-exposed devices.

An attacker identifies a Tenda AC8V4 router with its web management interface exposed to the internet (or positions themselves on the LAN). They send a crafted HTTP POST request to /goform/SetSysTimeCfg with a maliciously oversized timeZone or timeType parameter value, triggering the stack buffer overflow. A publicly available POC on GitHub demonstrates this technique, and the resulting overflow causes the router to crash and restart, interrupting internet connectivity for all connected devices - or potentially enabling code execution if the firmware lacks stack protection mechanisms.