Vulnerability · Published Sep 28, 2025 · Assigned by VulDB
CVE-2025-11120Tenda AC8 SetServerConfig formSetServerConfig buffer overflow
High 8.8
In plain English
A high-severity buffer overflow in AC8 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.0% (higher than 91% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)4.0%top 9.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A weakness has been identified in Tenda AC8 16.03.34.06. The affected element is the function formSetServerConfig of the file /goform/SetServerConfig. Executing manipulation can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.
Affected products (as reported)
Weakness: CWE-120, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-326201 | Tenda AC8 SetServerConfig formSetServerConfig buffer overflow vdb-entry, technical-description
- VDB-326201 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #664065 | Shenzhen Tenda Technology Co., Ltd. Tenda AC8v4 Router Tenda AC8v4 (V16.03.34.06) Buffer Overflow third-party-advisory
- https://github.com/alc9700jmo/CVE/issues/19 exploit, issue-tracking
- https://www.tenda.com.cn/ product