Ac8 Firmware EUVD-2025-17365

CVSS 8.8 (High/Critical) reflects the technical severity: Network-accessible (AV:N), low attack complexity (AC:L), requires low privilege (PR:L—valid credentials), achieves high impact across confidentiality, integrity, and availability. However, the PR:L requirement is a significant real-world friction factor; this is not an unauthenticated remote code execution. The public POC disclosure and KEV listing indicate genuine exploitation interest, elevating practical risk beyond baseline CVSS. EPSS scoring (if available) would likely reflect 60-75% exploitation probability given POC availability and simple attack preconditions. From an SSVC perspective: exploitation is publicly available (active), likely automatable given router management interface accessibility, and technical impact is total system compromise. This is a genuine priority for: (1) organizations with exposed Tenda AC8 devices and compromised/weak admin credentials, (2) ISP/corporate network environments where router compromise enables lateral movement, (3) supply-chain scenarios where firmware updates are unavailable. The main mitigating factor is the authentication requirement, which prevents blind mass exploitation but does not reduce severity for targeted attacks or insider threats.

An attacker with valid router credentials (obtained via phishing, credential stuffing, or default credentials) authenticates to the Tenda AC8 web interface (http://router-ip:80 or https://router-ip:443). The attacker sends a crafted HTTP POST request to /goform/SetSysTimeCfg with a maliciously oversized or specially crafted timeType parameter that overflows the stack buffer in the fromSetSysTime function. The overflow overwrites the function's return address with a pointer to attacker-controlled shellcode or ROP gadget chain. Upon function return, execution jumps to the attacker's payload, granting code execution with the privileges of the web server process (typically root on embedded routers). The attacker can then install a persistent backdoor, modify firewall rules, intercept traffic, pivot to internal network devices, or launch further attacks. Public POC availability means this exploitation path requires minimal expertise. Attack timeline: reconnaissance (network scan to identify Tenda AC8) → credential acquisition (weak admin password or phishing) → payload delivery (single HTTP request) → full system compromise (minutes). No user interaction required once authenticated.