CVE-2025-12618 is a high severity buffer overflow (CVSS 8.8) in the Tenda AC8 router, firmware 16.03.34.06. It sits in the an unidentified function function behind /goform/DatabaseIniSet, reached through the Time argument. The record lists no fixed firmware, so isolate the admin interface and check Tenda for an update.
What's affected
The record lists the Tenda AC8 and its firmware. The version named is 16.03.34.06. The vulnerable handler is an unidentified function, exposed at /goform/DatabaseIniSet, and the argument that triggers the problem is Time.
The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It is network reachable, low complexity, and it needs a logged-in account. Impact on confidentiality, integrity and availability is rated high. The CVE description says the exploit is public and might be used.
The record does not name a fixed firmware version. Do not assume that a newer release fixes this one. Look at the Tenda download page for your model and read the release notes, and treat the device as vulnerable until Tenda says otherwise.
How to check if you're exposed
You need two facts: the model and firmware you run, and whether the admin interface can be reached from places it should not be.
- Sign in to the router's admin page from inside your network and open the system status or firmware page. Note the model and the version string. If it reads 16.03.34.06, you are on the version in the record.
- Check whether remote management is enabled. If the admin page answers on the WAN address, the exposure is much larger.
- From an outside network you control, confirm that the admin port does not respond.
- Look for any router of this model in asset lists, branch offices, and staff home offices that you support.
Routers do not appear in package manifests, so a dependency scan will not find this. The free in-browser scan is useful for the software around the network edge, and the Gold page for CVE-2025-12618 tracks this record.
What to do now
- Inventory every AC8. Include spares and devices in remote offices.
- Turn off remote (WAN side) administration. Allow admin access only from a trusted management network.
- Make sure the admin password is not the factory default and is not reused elsewhere.
- Check the Tenda support page for your model. If newer firmware exists, read its notes, back up settings and update. The advisory or release notes should state whether this CVE is fixed. Confirm it rather than inferring it.
- If the model is no longer updated, plan to replace it. A public exploit and no patch is a poor basis for keeping an internet edge device.
- Segment the router from sensitive systems, and watch for unexpected reboots or configuration changes.
Why it matters
A buffer overflow happens when code copies input into a fixed size memory area without checking how long the input is. The record maps this one to CWE-119 and CWE-120. On a consumer router, the web server and its handlers usually run with high privilege, so memory corruption in a handler can give an attacker control of the device.
Edge devices matter because they sit between your network and everything else. Once one is compromised, traffic can be watched, redirected or used as a stepping stone. The record does not flag CVE-2025-12618 as a CISA Known Exploited Vulnerability and does not claim exploitation in the wild. It does say an exploit is public, which is enough reason to act.
Quick check
Which firmware version does the record name?
It names 16.03.34.06 for the Tenda AC8. Other versions may be affected too, so check the vendor if you run something different.
Is a fixed version available?
The record does not list one. Check Tenda's download page and release notes for your model before you rely on any update.
Sources
References listed in the CVE record:
- https://pan.baidu.com/s/11fdpTujKw6Xz0yPE2l4cMw
- https://vuldb.com/?ctiid.330912
- Gold entry for CVE-2025-12618
Last reviewed: 19 October 2026.
