A stack-based buffer overflow was discovered in the HTTP endpoint /goform/SysToolChangePwd of the Tenda AC8 router. The vulnerability is caused by manipulation of the argument local_2c in the doSystemCmd function, which overflows a stack buffer. The described impact is that an attacker can initiate the exploit remotely and the public exploit code is available. Based on the description, it is inferred that an attacker may potentially execute arbitrary code on the device.

Tenda AC8 routers running firmware versions up to and including 16.03.50.11 are affected. The vulnerability targets the component HTTP Endpoint, specifically the function doSystemCmd within /goform/SysToolChangePwd. CPE identifiers cpe:2.3:h:tenda:ac8:5.0:*:*:*:*:*:*:* and cpe:2.3:o:tenda:ac8_firmware:*:*:*:*:*:*:* indicate the impacted product model and firmware family.

The base CVSS score is 9.3, indicating critical severity, and the EPSS score is less than 1 %, suggesting a low likelihood of in‑the‑wild exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is described as remote via HTTP, with no authentication requirement. Based on the nature of the overflow, it is inferred that an attacker could potentially execute arbitrary code on the device.