CVE-2025-51087
Published: 24 July 2025
Summary
CVE-2025-51087 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Tenda Ac8 Firmware. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
Tenda AC8V4 firmware version V16.03.34.06 contains a stack-based buffer overflow vulnerability in the /goform/saveParentControlInfo endpoint, where unsanitized input to the time argument triggers CWE-121. The flaw received a CVSS 3.1 score of 8.6 reflecting network-accessible, low-complexity conditions without authentication or user interaction.
An unauthenticated remote attacker can send a crafted HTTP request that overflows the stack, potentially achieving arbitrary code execution or memory corruption with high confidentiality impact and limited integrity or availability effects. Exploitation requires only standard network reachability to the device's web interface.
Public references consist of the vendor site at tenda.com and a detailed technical write-up on GitHub that includes proof-of-concept material, but no official patch or mitigation guidance is referenced in the available data. The EPSS score has remained flat at 0.0125 with no observed increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22524
Vulnerability details
Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/saveParentControlInfo. The manipulation of the argument time leads to stack-based buffer overflow.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The stack-based buffer overflow vulnerability in the Tenda AC8V4 router's web interface (/goform/saveParentControlInfo) via the 'time' parameter enables remote exploitation of a public-facing application, aligning with T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely remediation of identified flaws like this stack buffer overflow by applying vendor firmware patches.
SI-10 mandates validation of information inputs such as the 'time' argument to prevent stack-based buffer overflows at the /goform/saveParentControlInfo endpoint.
SI-16 implements memory protections like stack canaries and DEP to mitigate exploitation of stack buffer overflows even if input validation fails.