Tenda AC8V4 CVE-2025-51088

The /goform/WifiGuestSet endpoint must be reachable by the attacker. Per the CVSS vector (AV:N/PR:N), the endpoint is network-accessible and requires no authentication - consistent with Tenda's common pattern of exposing goform handlers without session validation. If the router's admin interface is bound only to the LAN interface (the factory default on most Tenda AC models), exploitation is limited to local network attackers or those who have already achieved LAN presence. If remote management is enabled, the attack is fully internet-facing. No special firmware configuration, feature toggle, or guest network activation state is confirmed as a prerequisite from the description; the handler appears reachable regardless of whether the guest SSID is active.

The official CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) materially understates practical risk. The network vector, zero complexity, and no-authentication metrics describe a trivially reachable attack surface, while the A:L availability-only impact likely reflects conservative NVD scoring practice rather than an empirical ceiling for embedded firmware stack overflows. EPSS at 6.77% (93rd percentile) signals that the broader security community views exploitation as comparatively likely versus all other CVEs. A publicly available PoC (GitHub) confirms the vulnerability is reproducible and the bar for exploitation is low. SSVC signals: exploitation status is 'PoC available' (not none), the attack is automatable (AV:N/AC:L/PR:N), and technical impact on a router - a network gateway - elevates downstream risk beyond the device itself. The primary uncertainty is whether the router's admin interface is WAN-facing in a given deployment; LAN-only access significantly constrains the attacker population.

An unauthenticated attacker on the same network (or via WAN if remote administration is enabled) sends a crafted HTTP POST request to /goform/WifiGuestSet with an excessively long shareSpeed value. The firmware copies this value into a fixed stack buffer without length validation, overwriting the return address; on embedded devices lacking stack canaries, this halts or reboots the router at minimum, and with the publicly available PoC as a starting point, a motivated attacker can craft a ROP chain to achieve remote code execution as the httpd process owner.