CVE-2025-25663

A vulnerability was found in Tenda AC8V4 V16.03.34.06

Critical · published February 20, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
45.4
In the wild
Unconfirmed
What it is

🔥 A stack-based buffer overflow in Tenda AC8V4 could let attackers take control of your device just by manipulating a single argument! ⚡ Think of it like a waiter bringing you a surprise dish you didn’t order—except, instead of a meal, it’s a nasty security hole that could let an attacker feast on your data! If exploited, this vulnerability could allow an attacker to execute arbitrary code, potentially taking full control of your router. This means they could snoop on your network, change settings, or even launch attacks on other devices connected to your network—absolutely devastating!

Put simply

Think of it like a waiter bringing you a surprise dish you didn’t order—except, instead of a meal, it’s a nasty security hole that could let an attacker feast on your data! The vulnerability lies in the function SUB_0046AC38 within the file /goform/WifiExtraSet, where improper handling of the argument wpapsk_crypto leads to a stack-based buffer overflow. This flaw makes the system susceptible to remote code execution without authentication.

What to do

If exploited, this vulnerability could allow an attacker to execute arbitrary code, potentially taking full control of your router. This means they could snoop on your network, change settings, or even launch attacks on other devices connected to your network—absolutely devastating! Immediate action is required! Update your Tenda AC8V4 to the latest firmware version to patch this vulnerability and ensure your device is secure. Regularly check for updates and audit your device settings to maintain security. 🛡️ You've got this! Follow these steps and secure your router like the security hero you are! 🎉

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00553 · 45.4th percentile
Published
2025-02-20T00:00Z
EPSS history
Timeline
  • 20 FEB 00:00Z
    A vulnerability was found in Tenda AC8V4 V16.03.34.06
    cvelistv5