What is the CVSS score of CVE-2025-61498?

CVE-2025-61498 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Tenda AC8 are affected by CVE-2025-61498?

Tenda AC8 routers are vulnerable to unauthenticated remote denial-of-service attacks through publicly available exploit code, with no patch currently available from the vendor.

How to fix or mitigate CVE-2025-61498?

Within 24 hours: Inventory all Tenda AC8 routers (model AC8, hardware revision v03.03.10.01) in production and segment them from untrusted networks. Within 7 days: Disable UPnP services on all affected devices if operationally feasible, or implement network-level controls to restrict inbound UPnP traffic (UDP port 1900). Within 30 days: Develop a replacement strategy; evaluate alternatives from vendors with active security patching and establish a refresh timeline.

Tenda AC8 CVE-2025-61498

HIGH

Stack-based Buffer Overflow (CWE-121)

2025-10-30 cve@mitre.org

Buffer Overflow Tenda Denial Of Service Stack Overflow Ac8 Firmware

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated crafted packet to a network-reachable UPnP service (PR:N/AC:L) causing device crash; availability-only impact (A:H) with no C/I compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 03:13 vuln.today

DescriptionCVE.org

A buffer overflow in the UPnP service of Tenda AC8 Hardware v03.03.10.01 allows attackers to cause a Denial of Service (DoS) via supplying a crafted packet.

AnalysisAI

Denial of service in the Tenda AC8 dual-band gigabit router (hardware revision v03.03.10.01) allows a remote attacker to crash the device by sending a single crafted packet to its UPnP service, triggering a stack-based buffer overflow (CWE-121). The flaw requires no authentication or user interaction per the CVSS vector (PR:N/UI:N) and impacts availability only (A:H, no confidentiality/integrity impact). Publicly available exploit material exists via a researcher GitHub repository, though the issue is not listed in CISA KEV and carries a modest EPSS score of 0.39% (31st percentile).

Technical ContextAI

The affected component is the UPnP (Universal Plug and Play) daemon running on the Tenda AC8, a consumer SOHO wireless router; the CPE cpe:2.3:o:tenda:ac8_firmware:03.03.10.01 pins the vulnerable code to firmware/hardware build 03.03.10.01. UPnP is a set of networking protocols (SSDP for discovery, SOAP/HTTP for control) that lets LAN devices auto-configure port mappings; Tenda routers implement this in native C service binaries. The root cause is CWE-121 (stack-based buffer overflow): the UPnP handler copies attacker-controlled data from an incoming packet into a fixed-size stack buffer without adequate bounds checking, corrupting the stack frame. On these MIPS/ARM embedded targets such corruption typically overwrites the return address and crashes the process (or the device), consistent with the availability-only impact reported here.

RemediationAI

No vendor-released patch identified at time of analysis - the only available reference is a researcher GitHub repository (https://github.com/sakshi-garg02/CVEs/tree/main/CVE-2025-61498), not a Tenda advisory or fixed firmware version, so no exact fix version can be cited. As compensating controls: disable UPnP on the router if the feature is not needed (side effect: applications and consoles relying on automatic port-forwarding must be configured manually); ensure UPnP/SSDP (UDP 1900 and the associated SOAP control port) is not reachable from the WAN interface and is blocked at any upstream firewall (side effect: none for typical home use, since UPnP should never face the internet); and restrict LAN access to trusted devices, since exploitation requires network reachability to the UPnP service. Monitor Tenda's support site for updated AC8 firmware superseding v03.03.10.01 and apply it once released.