Tenda AC8V4 CVE-2025-51089

The Tenda AC8V4 web management interface must be reachable by the attacker - by default this is the LAN-side HTTP server (typically port 80), and exploitation is possible from any device on the local network without authentication. If the router's remote management feature is enabled (non-default but common in some deployments), exploitation is also possible from the WAN side over the internet. The vulnerable endpoint /goform/GetParentControlInfo is part of the parental control feature and is accessible in the router's default configuration without requiring login, consistent with the CVSS PR:N rating. No special configuration, credential, or session token is required. Limiting factors include: the attack is constrained to network access (LAN by default, WAN only if remote management is explicitly enabled); no exploitation from the internet without that non-default setting; and the scope is unchanged (S:U), meaning pivot to other network hosts requires additional post-exploitation steps.

Multiple risk signals converge on this being a genuine priority for affected device owners. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated, low-complexity network exploitation with no user interaction - the most dangerous class of router vulnerabilities. The official CVSS score of 6.5 with C:N/I:L/A:L appears to significantly understate real-world impact: heap overflows in embedded router firmware running as root routinely enable full remote code execution, which would score 9.8 (Critical). The EPSS score of 5.54% at the 92nd percentile is a strong signal - it indicates this CVE is in the top 8% of all CVEs by predicted exploitation likelihood. A public POC is available on GitHub, lowering the barrier for exploitation substantially. No KEV listing is confirmed at time of analysis, so active exploitation in campaigns has not been confirmed by CISA. The discrepancy between the official I:L/A:L impact rating and the typical exploitation outcome for this class of vulnerability (heap overflow, no auth, root-running process) should be independently verified against the published POC.

An unauthenticated attacker on the same LAN (or internet-facing if remote management is enabled) sends a crafted HTTP GET or POST request to /goform/GetParentControlInfo with an oversized or malformed mac parameter value. The firmware copies this value into a fixed-size heap buffer without bounds checking, overwriting adjacent heap metadata or function pointers. A public POC on GitHub demonstrates the heap corruption trigger; on affected embedded firmware lacking heap hardening, this can be leveraged to redirect execution to attacker-controlled shellcode or ROP chains, potentially yielding a root shell on the router.