CVE-2026-4254CWE-119CWE-121

Tenda AC8 HTTP Endpoint SysToolChangePwd doSystemCmd stack-based overflow

Critical · published March 16, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
71.7
In the wild
Unconfirmed
What it is

A weakness has been identified in Tenda AC8 up to 16.03.50.11. This vulnerability affects the function doSystemCmd of the file /goform/SysToolChangePwd of the component HTTP Endpoint. This manipulation of the argument local_2c causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.01370 · 71.7th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-121 · Stack-based Buffer Overflow
Published
2026-03-16T17:32Z
EPSS history
Timeline
  • 16 MAR 17:32Z
    Tenda AC8 HTTP Endpoint SysToolChangePwd doSystemCmd stack-based overflow
    cvelistv5