Description
A vulnerability was detected in Tenda AC8 16.03.33.05. Affected is the function fromSetWifiGusetBasic of the file /goform/WifiGuestSet of the component httpd. The manipulation of the argument shareSpeed results in buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.
Published: 2026-02-09
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote buffer overflow potentially enabling code execution on the device
Action: Patch Now
AI Analysis

Impact

The Tenda AC8 firmware 16.03.33.05 contains a buffer overflow flaw in the fromSetWifiGusetBasic function exposed via the httpd /goform/WifiGuestSet endpoint; manipulation of the shareSpeed argument can overflow the stack and lead to arbitrary code execution if triggered remotely.

Affected Systems

The vulnerability affects Tenda AC8 routers running firmware version 16.03.33.05; no other versions are listed as affected in the provided data.

Risk and Exploitability

With a CVSS score of 8.7 the flaw is high severity; the EPSS score being less than 1% indicates a low current exploitation probability, and it is not listed in CISA’s KEV catalog. The attack can be launched from a remote host without authentication, leveraging the publicly available exploit code to potentially gain full control of the device.

Generated by OpenCVE AI on April 17, 2026 at 21:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Tenda AC8 firmware update available from the vendor’s website to fix the buffer overflow in the WifiGuestSet handler
  • If a firmware update cannot be applied, disable the guest WiFi share speed feature or block external access to the /goform/WifiGuestSet endpoint to prevent remote exploitation
  • Continuously monitor device logs and network traffic for anomalous activity and enforce firewall rules to restrict unauthorized external access to the router

Generated by OpenCVE AI on April 17, 2026 at 21:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Feb 2026 10:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:tenda:ac8_firmware:*:*:*:*:*:*:*:*

Tue, 10 Feb 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Tenda ac8 Firmware
CPEs cpe:2.3:h:tenda:ac8:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:ac8_firmware:16.03.33.05:*:*:*:*:*:*:*
Vendors & Products Tenda ac8 Firmware

Mon, 09 Feb 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 09 Feb 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Tenda
Tenda ac8
Vendors & Products Tenda
Tenda ac8

Mon, 09 Feb 2026 02:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Tenda AC8 16.03.33.05. Affected is the function fromSetWifiGusetBasic of the file /goform/WifiGuestSet of the component httpd. The manipulation of the argument shareSpeed results in buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.
Title Tenda AC8 httpd WifiGuestSet fromSetWifiGusetBasic buffer overflow
Weaknesses CWE-119
CWE-120
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda Ac8 Ac8 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:53:28.713Z

Reserved: 2026-02-07T17:49:16.946Z

Link: CVE-2026-2202

cve-icon Vulnrichment

Updated: 2026-02-09T16:37:19.585Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-09T03:16:13.590

Modified: 2026-02-10T15:07:30.390

Link: CVE-2026-2202

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T21:45:28Z

Weaknesses