What is the CVSS score of CVE-2025-51088?

CVE-2025-51088 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 6.8%.

Is there a public PoC exploit available for CVE-2025-51088?

Yes, a public proof-of-concept exploit is available for CVE-2025-51088. Prioritise patching immediately. EPSS: 6.8%.

Tenda AC8V4 CVE-2025-51088

MEDIUM

Stack-based Buffer Overflow (CWE-121)

2025-07-24 cve@mitre.org

Buffer Overflow Tenda Stack Overflow Ac8 Firmware

5.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

7.5 HIGH

Network-accessible unauthenticated endpoint; stack overflow in router firmware causes device crash or reboot warranting A:H; no confirmed confidentiality or integrity impact from available data.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 03:46 vuln.today

DescriptionCVE.org

Tenda AC8V4 V16.03.34.06 was discovered to contain stack overflow at /goform/WifiGuestSet. The manipulation of the argument shareSpeed` leads to stack-based buffer overflow.

AnalysisAI

Stack-based buffer overflow in Tenda AC8V4 firmware V16.03.34.06 exposes the /goform/WifiGuestSet HTTP endpoint to unauthenticated remote attackers via the shareSpeed parameter, which lacks proper bounds checking before stack allocation. The official CVSS scores only availability impact (A:L), but stack overflows in embedded router firmware routinely yield remote code execution in practice - the 93rd-percentile EPSS score and a publicly available PoC reinforce elevated real-world risk. No public exploitation or CISA KEV listing has been confirmed at time of analysis, though the PoC lowers the barrier to active targeting of unpatched devices.

Technical ContextAI

The affected product is a SOHO wireless router running Tenda AC8 firmware version 16.03.34.06 (CPE: cpe:2.3:o:tenda:ac8_firmware:16.03.34.06:*:*:*:*:*:*:*). The vulnerability resides in the HTTP-based CGI form handler /goform/WifiGuestSet, responsible for configuring the guest Wi-Fi network's bandwidth throttling. The shareSpeed parameter is copied into a fixed-size stack buffer without validating the input length, satisfying CWE-121 (Stack-Based Buffer Overflow). Tenda's embedded firmware is built on a lightweight web server (typically httpd or similar) running on a MIPS/ARM SoC with limited memory protections; stack canaries and ASLR are frequently absent or ineffective on this class of device, making stack overflows straightforward to exploit for control-flow hijack.

RemediationAI

No vendor-released patch has been identified at time of analysis; Tenda has not published a security advisory for this CVE. As a primary compensating control, disable remote (WAN-side) management on the router's administration interface to confine the attack surface to the local network - note this does not protect against compromised LAN hosts. Restrict access to the /goform/ CGI endpoints via firewall rules or by placing the router's management IP behind an access control list if the firmware permits it. Consider replacing the device with a model receiving active security support, as Tenda's update cadence for older AC series firmware is inconsistent. Monitor the PoC repository at the reference URL for updates indicating weaponized or wormable variants. Organizations with this device in sensitive network positions should treat it as untrusted and segment accordingly.