PT-2023-27685 · Tenda+1 · Tenda Ac8+1

Published 2023-08-24 · Updated 2025-12-08 · CVE-2023-40891

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda AC8 version US AC8V4.0si V16.03.34.06 cn Zyxel CPE (affected versions not specified)

Description A stack overflow issue was discovered in Tenda AC8 via the firewallEn parameter at the "/goform/SetFirewallCfg" API endpoint. For Zyxel CPE devices, a critical vulnerability allows remote attackers to execute arbitrary commands with "supervisor" or "zyuser" privileges by sending specially crafted network requests via the telnet protocol. Over 1500 vulnerable Zyxel CPE routers have been detected, primarily in the Philippines, Turkey, the UK, and France. Although less common in Russia, these devices can still be found among small organizations, telecom operators, and private users.

Recommendations For Tenda AC8 version US AC8V4.0si V16.03.34.06 cn, consider disabling access to the "/goform/SetFirewallCfg" API endpoint until a patch is available. For Zyxel CPE devices, use firewalls to limit remote access, create a "whitelist" of IP addresses for access, and apply secure communications for remote access. At the moment, there is no information about a newer version that contains a fix for this vulnerability in Zyxel CPE devices.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2023-40891

Affected Products

Tenda Ac8

Zyxel Cpe

References · 7

• 🔥 https://github.com/peris-navince/founded-0-days/blob/main/ac8/formSetFirewallCfg/1.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-40891 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40891 · Security Note
• https://t.me/cveNotify/145104 · Telegram Post
• https://t.me/echeloneyes/3606 · Telegram Post
• https://t.me/cibsecurity/69147 · Telegram Post
• https://t.me/cvenotify/57212 · Telegram Post