All intelligence
// vulnerability record
cached · NVD via COSMOS syncCVE-2026-4254
HIGHpublished 2026-03-16 18:16 UTC · 5 months ago · modified 2026-06-17 10:56 UTC
8.9
CVSS / 10
// description
A weakness has been identified in Tenda AC8 up to 16.03.50.11. This vulnerability affects the function doSystemCmd of the file /goform/SysToolChangePwd of the component HTTP Endpoint. This manipulation of the argument local_2c causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
// weaknesses (CWE)
- CWE-119
- CWE-121
- CWE-787