A stack-based buffer overflow exists in the Tenda AC8 router’s Httpd service within the webCgiGetUploadFile function of the /cgi-bin/UploadCfg endpoint. The CVE description notes that malformed input can corrupt the stack, and that the vulnerability can be triggered remotely. The specific consequences are not explicitly detailed, but the nature of the overflow suggests that the attacker might be able to execute code on the device. Based on typical outcomes of such bugs, it is inferred that the flaw could potentially enable remote execution of arbitrary commands, though the CVE itself does not state this overtly.

Devices affected are Tenda AC8 routers running firmware version 16.03.34.06. The vulnerability is specific to the Httpd service in that firmware build; no other firmware versions are explicitly mentioned in the CNA data.

The CVSS score of 8.7 indicates a high potential impact, and publicly disclosed exploits confirm that the vulnerability is actionable from a remote source. The EPSS score is less than 1 %, implying that the likelihood of exploitation is currently low, but the threat remains because the flaw can be leveraged over the Internet. The specific exploit outcome is not explicitly documented, but given the nature of the stack-based overflow, it is inferred that a successful exploit could lead to remote code execution. The vulnerability is not listed in the CISA KEV catalog, yet administrators should prioritize mitigating it, especially on devices exposed to external networks.