PT-2025-7562 · Tenda · Tenda Ac8V4

Published 2025-02-20 · Updated 2025-02-22 · CVE-2025-25663

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda AC8V4 version V16.03.34.06

Description A vulnerability was found in the function SUB 0046AC38 of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk crypto leads to a stack-based buffer overflow.

Recommendations For Tenda AC8V4 version V16.03.34.06, consider disabling the SUB 0046AC38 function as a temporary workaround until a patch is available. Restrict access to the /goform/WifiExtraSet file to minimize the risk of exploitation. Avoid using the wpapsk crypto argument in the affected API endpoint until the issue is resolved.

Exploit

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-120

Related Identifiers

BDU:2025-04002

CVE-2025-25663

Affected Products

Tenda Ac8V4

References · 9

• 🔥 https://github.com/jangfan/my-vuln/blob/main/Tenda/AC8V4/WifiExtraSet.md · Exploit
• https://bdu.fstec.ru/vul/2025-04002 · Security Note
• https://osv.dev/vulnerability/CVE-2025-25663 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25663 · Security Note
• https://twitter.com/cybercronai/status/1893088827918487750 · Twitter Post
• https://tendacn.com/product/download/ac8.html · Note
• https://twitter.com/CVEnew/status/1892706502617497834 · Twitter Post
• https://vulners.com/cve/CVE-2025-25663 · Note
• https://t.me/cvedetector/18608 · Telegram Post