CVE-2025-25667

Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the urls parameter in the function get_parentControl_list_Info

Critical · published February 20, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
46.6
In the wild
Unconfirmed
What it is

🔥 A stack overflow vulnerability in the Tenda AC8V4 router could let attackers send carefully crafted URLs to crash your device—think of it as a mischievous prankster pouring too much foam into a soda bottle! This vulnerability is like a waiter who never checks if a customer’s order is too big for the table—eventually, it spills over, and chaos ensues. Here, a simple URL actually overflows the stack, causing potential instability. If exploited, this could lead to a complete system crash, making your router unusable and leaving your network wide open to further attacks. An attacker could take control of your device or disrupt your internet access entirely; it's a recipe for absolute chaos!

Put simply

This vulnerability is like a waiter who never checks if a customer’s order is too big for the table—eventually, it spills over, and chaos ensues. Here, a simple URL actually overflows the stack, causing potential instability. The vulnerability arises in the function get_parentControl_list_Info due to improper handling of the urls parameter, which allows for a stack overflow when excessively long input is provided.

What to do

If exploited, this could lead to a complete system crash, making your router unusable and leaving your network wide open to further attacks. An attacker could take control of your device or disrupt your internet access entirely; it's a recipe for absolute chaos! Immediately apply the firmware update to version V16.03.34.07 to patch this issue. Additionally, audit your network settings and disable remote management if it's not needed to reduce risk. Keeping an eye on router configuration can prevent similar incidents! You've got this! By taking these steps, you'll be well on your way to securing your network. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00572 · 46.6th percentile
Published
2025-02-20T00:00Z
EPSS history
Timeline
  • 20 FEB 00:00Z
    Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the urls parameter in the function get_parentControl_list_Info
    cvelistv5