EUVD-2025-17365CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability was found in Tenda AC8 16.03.34.09. It has been classified as critical. Affected is the function fromSetSysTime of the file /goform/SetSysTimeCfg. The manipulation of the argument timeType leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
Critical stack-based buffer overflow vulnerability in Tenda AC8 router firmware version 16.03.34.09, exploitable via the timeType parameter in the /goform/SetSysTimeCfg endpoint. An authenticated remote attacker can leverage this vulnerability to achieve arbitrary code execution with full system compromise (confidentiality, integrity, and availability impact). Public exploit disclosure and confirmed proof-of-concept availability indicate active threat potential, though exploitation requires valid authentication credentials.
Technical Context
The vulnerability exists in the fromSetSysTime function of Tenda AC8 wireless router firmware, specifically within the web-based management interface accessible at /goform/SetSysTimeCfg. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow condition where user-supplied input via the timeType parameter is not properly validated before being written to a stack-allocated buffer. The Tenda AC8 is a 802.11ac dual-band router running proprietary firmware; affected CPE would be cpe:2.3:o:tenda:ac8_firmware:16.03.34.09:*:*:*:*:*:*:*. The HTTP-based management interface accepts the timeType argument without sufficient bounds checking, allowing stack memory corruption and potential code execution through return-oriented programming (ROP) or direct shellcode injection.
Affected Products
AC8 Wireless Router (['16.03.34.09'])
Remediation
Immediate actions: (1) Check Tenda's official security advisories and firmware repository (https://www.tenda.com.cn/) for patched firmware versions beyond 16.03.34.09; if available, apply immediately via router admin interface (System Settings > Firmware Upgrade). (2) If patched firmware is unavailable, restrict access to the router's web management interface (port 80/443 default) using network segmentation, firewall rules, or disabling remote management (LAN-only access). (3) Enforce strong, unique administrative credentials (minimum 12 characters, non-default username) to reduce authentication bypass risk. (4) Monitor router logs for suspicious SetSysTimeCfg requests or timeType parameter anomalies. (5) As temporary mitigation, block or restrict inbound HTTP/HTTPS traffic to the router WAN interface if remote administration is not required. (6) Segment the router on a management VLAN if deployed in enterprise settings. Monitor Tenda's security page and CVE databases for patch availability; legacy router firmware often receives limited maintenance, so hardware replacement may be necessary if no patch emerges within 90 days.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today