What is the CVSS score of CVE-2026-4254?

CVE-2026-4254 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda are affected by CVE-2026-4254?

A critical remote code execution vulnerability affects Tenda AC8 routers up to firmware version 16.03.50.11, allowing unauthenticated attackers to execute arbitrary commands.

How to fix or mitigate CVE-2026-4254?

Within 24 hours: Inventory all Tenda AC8 devices in your network and isolate affected units from critical systems. Within 7 days: Implement network segmentation to restrict router access and deploy WAF rules blocking HTTP requests to /goform/SysToolChangePwd endpoint. Within 30 days: Evaluate replacing vulnerable Tenda AC8 routers with patched alternatives or devices from alternative vendors, or deploy compensating controls if replacement is infeasible.

Tenda CVE-2026-4254

EUVD-2026-12488 CRITICAL

Buffer Overflow (CWE-119)

2026-03-16 cna@vuldb.com

Buffer Overflow Tenda

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 18:30 euvd

EUVD-2026-12488

Analysis Generated

Mar 16, 2026 - 18:30 vuln.today

CVE Published

Mar 16, 2026 - 18:16 nvd

CRITICAL 9.8

DescriptionCVE.org

A weakness has been identified in Tenda AC8 up to 16.03.50.11. This vulnerability affects the function doSystemCmd of the file /goform/SysToolChangePwd of the component HTTP Endpoint. This manipulation of the argument local_2c causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Remote code execution in Tenda AC8 firmware versions up to 16.03.50.11 results from a stack-based buffer overflow in the HTTP endpoint handling password change requests. An unauthenticated attacker can exploit this vulnerability over the network to execute arbitrary commands with full system privileges. Public exploit code exists for this vulnerability and no patch is currently available.

Technical ContextAI

The vulnerability resides in the doSystemCmd function that processes HTTP requests to the /goform/SysToolChangePwd endpoint on Tenda AC8 wireless routers. The flaw is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow condition where user-supplied input to the local_2c argument is not properly validated before being copied to a fixed-size stack buffer. This allows attackers to overwrite adjacent memory locations on the stack, potentially including the return address, enabling arbitrary code execution. The affected Tenda AC8 is a consumer-grade wireless router commonly used in home and small office environments.

RemediationAI

No patch or fixed firmware version has been identified in the available intelligence sources. Given the critical nature and public exploit availability, affected users should immediately disable remote management features and restrict administrative interface access to trusted local network segments only. Consider replacing the affected Tenda AC8 router with a device from a vendor with active security support if no patch becomes available. Monitor the vendor website at https://www.tenda.com.cn/ and the vulnerability references at https://vuldb.com/?id.351212 for updates on patch availability.