CVE-2025-25664 is a critical (CVSS 9.8) stack overflow in the Tenda AC8V4, firmware V16.03.34.06. The record lists no fixed version. Check Tenda's support page for new firmware, turn off remote administration, and replace the device if it no longer receives updates.
What's affected
- Product: Tenda AC8V4 router or access point and its firmware.
- Affected: firmware V16.03.34.06, as named in the record. Other builds may share the code, so do not assume a newer or older build is safe without checking the vendor.
- Fixed: the record names no fixed version. Check the vendor's download page, and read any release notes before you flash.
- Detail: the shareSpeed parameter in function sub_49E098 is not bounded. The researcher notes the handler relates to IP and MAC binding settings.
- Vector: network reachable, no login and no user interaction, which is how it reaches 9.8.
How to check if you're exposed
Find the firmware version in the router's admin page, usually under a system status or firmware upgrade menu. Menu names differ by model, so use the vendor's manual if you cannot find it. Compare the version string with V16.03.34.06.
Then check whether the admin interface is reachable from the wrong places. From a machine outside your network, scan only your own public address.
nmap -Pn -p 80,443,8080 <your-public-ip>
Also check the router's settings for remote management, port forwarding and UPnP rules. If the web interface answers from the internet, treat the device as exposed. Look at the device logs if it keeps any, and for unexpected reboots or changed settings, which can indicate someone tried to use a flaw like this.
At a larger site, build a list of every Tenda device with its model and firmware so you know how many are affected.
What to do now
- Check Tenda's support or download page for firmware newer than V16.03.34.06 for the AC8V4, and read its release notes before you flash.
- Turn off remote administration and make sure no port forward or UPnP rule exposes the web interface.
- Restrict the admin page to a small set of trusted internal addresses, and change the admin password to a long unique one.
- Keep guests and untrusted devices on a separate network from the one that can reach the admin interface.
- If no update exists or the product is out of support, plan to replace the device with a model that still receives security fixes.
- If the device was exposed to the internet, check its settings for changes you did not make, reset it to factory defaults and reconfigure it from scratch.
Why it matters
The class is a memory safety bug. A web handler on the device reads a request value and copies it into a fixed size buffer without checking its length. When the value is longer than the buffer, the extra bytes overwrite neighbouring memory on the stack.
- CWE-120 is a buffer copy without checking the size of the input. The program copies caller supplied data into a fixed size buffer and trusts the length.
- CWE-787 is an out of bounds write. Memory outside the intended buffer gets overwritten, which on embedded devices can corrupt control data and change what the program does next.
The record also tags CWE-787, an out of bounds write. The effect on the device is memory corruption on the device, which can mean a crash or code execution with the privileges of the web service. Consumer and small office routers sit at the network edge and see every connection in and out, which makes a compromise valuable. They also tend to run old firmware for years because nobody owns the update task.
The published writeup is by an independent researcher, and the record does not say the vendor has responded. Tenda sells many models on shared codebases, so a bug in one build often points to the same pattern elsewhere. Reduce exposure first. The router's web interface should never face the internet, and the update question should be on your inventory.
Quick check
Is there a patched firmware for CVE-2025-25664?
The record names no fixed version. Check Tenda's support page for the AC8V4, and replace the device if it no longer receives updates.
Is this the same bug as the other AC8V4 CVEs?
No. Several CVEs hit the same firmware in different handlers, each with its own parameter. They share a root cause pattern but need separate fixes.
Sources
Last reviewed: 19 October 2026.
