Ac8 Firmware CVE-2025-5799

This vulnerability presents substantial real-world risk across multiple dimensions. The CVSS 3.1 score of 8.8 reflects high severity with network-accessible attack vector (AV:N), low attack complexity (AC:L), and high impact across all three security properties (C:H/I:H/A:H). However, it requires low privilege level (PR:L), meaning an authenticated user (such as a guest network user or device with network access) can exploit it. The existence of public proof-of-concept code significantly elevates real-world risk. The disclosure of exploitation details means automated scanning and weaponized exploit kits are likely imminent or already in circulation. While requiring authentication reduces the immediate blast radius compared to unauthenticated RCE, authenticated network access is easily obtained in many environments. This should be treated as actively exploitable with high priority for patching.

An attacker with access to the router's network (e.g., a guest network user, compromised IoT device on the same network, or remote attacker if remote management is enabled) authenticates to the router's web interface using default or weak credentials. The attacker then crafts a POST request to /goform/WifiExtraSet with an oversized wpapsk_crypto parameter (typically a long string or binary payload exceeding the stack buffer size). The vulnerable fromSetWirelessRepeat function fails to validate input length, causing the buffer to overflow and overwrite the stack, including return addresses and saved registers. The attacker leverages this to inject shellcode or ROP gadgets to achieve arbitrary code execution with root privileges on the router. Once achieved, the attacker can install backdoors, intercept all network traffic, modify DNS settings, perform man-in-the-middle attacks, or pivot to other network devices. The low attack complexity and availability of public POC code means this can be automated and deployed at scale against Tenda AC8 installations.