Tenda AC8
CVE-2025-61498
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain LAN access to router
-
DeliveryCraft oversized UPnP packet
-
ExploitSend to UPnP service port
-
ExecutionOverflow stack buffer in handler
-
ImpactCrash daemon/device (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Tenda AC8's UPnP service on firmware v03.03.10.01 and the ability to send it a crafted (oversized) packet; no authentication or user interaction is needed per the CVSS vector (PR:N/UI:N/AC:L). The key limiting factor is that UPnP is normally bound to the LAN/private interface, so a realistic attacker must be on the local network (guest Wi-Fi, malicious/compromised LAN device) unless UPnP has been exposed to the WAN through misconfiguration; the impact is limited to denial of service (device crash/reboot) with no code execution or data exposure. Exploitation is also constrained to this specific hardware/firmware build. |
| Impact | The signals are internally consistent for a DoS-class embedded flaw: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes network-reachable, unauthenticated, low-complexity exploitation with high availability impact and no data compromise - a router crash/reboot, not code execution as reported. Corroborating this lower urgency, EPSS is only 0.39% (31st percentile), the CVE is NOT in CISA KEV, and there is no evidence of active exploitation. The main tension is the attack vector: UPnP is normally bound to the LAN/private interface, so AV:N is realistic only for an attacker already on the local network (or where UPnP is exposed to the WAN via misconfiguration) - the raw 7.5 likely overstates internet-facing risk for a default deployment. Treat this as a genuine but low-to-moderate priority: real for on-LAN or hostile-guest scenarios, limited blast radius (availability only), and no confirmed in-the-wild exploitation. |
| Exploit ScenarioDerived | An attacker on the same local network as a Tenda AC8 - for example a guest on the Wi-Fi, a compromised IoT device, or an actor reaching an internet-exposed UPnP port via misconfiguration - sends a single crafted UPnP packet to the router's service. The oversized field overflows a stack buffer in the UPnP handler and crashes the daemon or the device, dropping connectivity for everyone behind the router. Given AC:L and PR:N/UI:N, the attack is trivial to repeat, and proof-of-concept material appears to be published in the referenced repository. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 05, 2026
Denial of service in the Tenda AC8 dual-band gigabit router (hardware revision v03.03.10.01) allows a remote attacker to crash the device by sending a single crafted packet to its UPnP service, triggering a stack-based buffer overflow (CWE-121). The flaw requires no authentication or user interaction per the CVSS vector (PR:N/UI:N) and impacts availability only (A:H, no confidentiality/integrity impact). Publicly available exploit material exists via a researcher GitHub repository, though the issue is not listed in CISA KEV and carries a modest EPSS score of 0.39% (31st percentile).
RemediationAI
No vendor-released patch identified at time of analysis - the only available reference is a researcher GitHub repository (https://github.com/sakshi-garg02/CVEs/tree/main/CVE-2025-61498), not a Tenda advisory or fixed firmware version, so no exact fix version can be cited. As compensating controls: disable UPnP on the router if the feature is not needed (side effect: applications and consoles relying on automatic port-forwarding must be configured manually); ensure UPnP/SSDP (UDP 1900 and the associated SOAP control port) is not reachable from the WAN interface and is blocked at any upstream firewall (side effect: none for typical home use, since UPnP should never face the internet); and restrict LAN access to trusted devices, since exploitation requires network reachability to the UPnP service. Monitor Tenda's support site for updated AC8 firmware superseding v03.03.10.01 and apply it once released.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the UPnP (Universal Plug and Play) daemon running on the Tenda AC8, a consumer SOHO wireless router; the CPE cpe:2.3:o:tenda:ac8_firmware:03.03.10.01 pins the vulnerable code to firmware/hardware build 03.03.10.01. UPnP is a set of networking protocols (SSDP for discovery, SOAP/HTTP for control) that lets LAN devices auto-configure port mappings; Tenda routers implement this in native C service binaries. The root cause is CWE-121 (stack-based buffer overflow): the UPnP handler copies attacker-controlled data from an incoming packet into a fixed-size stack buffer without adequate bounds checking, corrupting the stack frame. On these MIPS/ARM embedded targets such corruption typically overwrites the return address and crashes the process (or the device), consistent with the availability-only impact reported here.
Know when Ac8 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated crafted packet to a network-reachable UPnP service (PR:N/AC:L) causing device crash; availability-only impact (A:H) with no C/I compromise.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
A buffer overflow in the UPnP service of Tenda AC8 Hardware v03.03.10.01 allows attackers to cause a Denial of Service (DoS) via supplying a crafted packet.
Executive ViewAI
Tenda AC8 routers are vulnerable to unauthenticated remote denial-of-service attacks through publicly available exploit code, with no patch currently available from the vendor. An attacker can crash affected devices with a single malicious packet, disrupting network connectivity for affected organizations without requiring credentials or user interaction. Immediate action is required to identify and mitigate deployed instances.
Disable UPnP service on affected Tenda AC8 devices if operationally feasible. Restrict network access to UPnP ports (UDP 1900) using firewall rules, allowing only authorized internal traffic. Implement continuous network monitoring for abnormal traffic patterns targeting UPnP services. Monitor for device reboots or availability changes on affected routers. Consider temporary network redundancy or failover mechanisms for critical connectivity paths dependent on these devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Ac8 Firmware
View allStack-based buffer overflow in the Tenda AC8V4 router (firmware V16.03.34.06) lets remote attackers corrupt memory by su
Vulnerability in Tenda AC8v4 .V16.03.34.09 due to sscanf and the last digit of s8 being overwritten with \x0. Rated crit
Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the sub_47D878 funct
Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the urls parameter in the function get_parentCon
Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the sub_49E098 funct
A vulnerability was found in Tenda AC8V4 V16.03.34.06. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability in the fromAdvSetMacMtuWan function. Rated critical severity
A vulnerability was found in Tenda AC8 16.03.34.06_cn_TDC01. Rated critical severity (CVSS 9.8), this vulnerability is r
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list at /goform/SetNe
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter macFilterType and par
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter timeZone at /goform/S
Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter mac at /goform/GetPar
Exploit-DB