Tenda AC8 CVE-2025-51087

Exploitation requires the ability to send an HTTP request to the router's web administration server and specifically to the /goform/saveParentControlInfo endpoint with a manipulated 'time' argument on the vulnerable firmware V16.03.34.06. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is stated as required and no non-default configuration is called out - i.e. remote unauthenticated triggering against a reachable AC8V4 admin interface. The primary real-world limiter is network reachability of that admin interface: SOHO routers usually expose web administration only on the LAN by default, so exploitation is most realistic from the local network or an adjacent/compromised host unless remote management is enabled or the WAN interface is exposed. Note the tension worth verifying: a parental-control configuration endpoint would ordinarily sit behind an authenticated session, which would contradict the PR:N rating if confirmed.

Signals are broadly consistent and point to a genuine priority for exposed devices: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, low-complexity, network-facing attack, and EPSS at 8.43%/94th percentile plus publicly available exploit code reinforce real exploitability. The base score of 8.6 reflects the NVD impact rating of C:H/I:L/A:L. Two caveats deserve verification: first, the impact metrics understate what a stack overflow on an unmitigated embedded target usually yields - such flaws commonly produce full crash/DoS (A:H) and often remote code execution (I:H/A:H), so C:H/I:L/A:L appears conservative. Second, /goform administrative endpoints on many routers normally sit behind an authenticated session, yet the vector asserts PR:N; if exploitation actually requires LAN access or an authenticated session in practice, real-world risk narrows to local/adjacent attackers or post-authentication abuse - this should be confirmed against the PoC. It is not on CISA KEV, so exploitation is demonstrated (PoC) but not confirmed in the wild.

An attacker who can reach the router's web management interface sends a crafted HTTP POST to /goform/saveParentControlInfo with an over-length 'time' parameter, smashing the stack buffer to crash the device or, on this unmitigated embedded target, to hiject execution and run attacker code on the router. Because publicly available exploit/PoC code exists and the CVSS vector rates it low-complexity and unauthenticated, weaponization effort is minimal for any adversary with network access to the admin service.