What is the CVSS score of CVE-2025-51089?

CVE-2025-51089 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 5.5%.

Is there a public PoC exploit available for CVE-2025-51089?

Yes, a public proof-of-concept exploit is available for CVE-2025-51089. Prioritise patching immediately. EPSS: 5.5%.

Tenda AC8V4 CVE-2025-51089

MEDIUM

Heap-based Buffer Overflow (CWE-122)

2025-07-24 cve@mitre.org

Heap Overflow Tenda Buffer Overflow Ac8 Firmware

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

9.8 CRITICAL

Unauthenticated heap overflow in a root-running embedded firmware CGI handler with no mitigations typically enables full RCE, warranting C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 03:47 vuln.today

DescriptionCVE.org

Tenda AC8V4 V16.03.34.06 was discovered to contain heap overflow at /goform/GetParentControlInfo.The manipulation of the argument mac` leads to heap-based buffer overflow.

AnalysisAI

Heap-based buffer overflow in Tenda AC8V4 router firmware V16.03.34.06 allows unauthenticated remote attackers to corrupt heap memory via a crafted mac parameter sent to the /goform/GetParentControlInfo endpoint. The vulnerability requires no authentication or user interaction and is reachable over the network, making it exploitable against any device whose web management interface is accessible. A publicly available proof-of-concept exists on GitHub, and the EPSS score of 5.54% at the 92nd percentile indicates elevated real-world exploitation probability relative to the broader CVE population; no public exploit identified at time of analysis confirms CISA KEV listing.

Technical ContextAI

The affected component is the CGI-based web server embedded in Tenda AC8V4 firmware version 16.03.34.06, as identified by CPE cpe:2.3:o:tenda:ac8_firmware:16.03.34.06:*:*:*:*:*:*:*. The /goform/GetParentControlInfo endpoint handles parental control lookups keyed by MAC address. The mac argument is copied into a heap-allocated buffer without adequate length validation, constituting a CWE-122 (Heap-based Buffer Overflow) defect. In embedded MIPS/ARM router firmware, heap overflows at known CGI handler offsets are frequently exploitable for arbitrary code execution because ASLR and heap canaries are either absent or weakly implemented, and the CGI processes typically run as root. The heap corruption can overwrite adjacent heap metadata or function pointers, creating a code execution primitive.

RemediationAI

No vendor-released patch has been identified at time of analysis - Tenda has not published a security advisory or updated firmware version in the available references. As a primary compensating control, restrict access to the router's web management interface by disabling WAN-side remote management (typically under Advanced Settings or Remote Management in the router UI); this prevents exploitation from the internet but does not protect against LAN-side attackers. If feasible, place the router's management plane on a dedicated VLAN accessible only to trusted administrator hosts using firewall ACLs, reducing the attack surface to a smaller trusted population. Disabling the parental controls feature entirely may prevent the vulnerable endpoint from being reachable, though this trade-off requires testing on the specific firmware version. Monitor Tenda's official firmware download page for AC8V4 for a patched release, and apply it immediately upon availability. Reference the POC at https://github.com/TL-SN/IOT/blob/main/Tenda/Tenda-AC8v4%20%20V16.03.34.06/CVE-2025-51089.md for additional technical context to assess compensating control effectiveness.