Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-4254

Tenda AC8 HTTP Endpoint SysToolChangePwd doSystemCmd stack-based overflow

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulDB

Description

A weakness has been identified in Tenda AC8 up to 16.03.50.11. This vulnerability affects the function doSystemCmd of the file /goform/SysToolChangePwd of the component HTTP Endpoint. This manipulation of the argument local_2c causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Tenda AC8

  • 16.03.50.0affected
  • 16.03.50.1affected
  • 16.03.50.2affected
  • 16.03.50.3affected
  • 16.03.50.4affected
  • 16.03.50.5affected
  • 16.03.50.6affected
  • 16.03.50.7affected
  • 16.03.50.8affected
  • 16.03.50.9affected
  • 16.03.50.10affected
  • 16.03.50.11affected

References