CVE-2025-25667: Critical Buffer Overflow in Tenda AC8V4

CVE-2025-25667 is a critical (CVSS 9.8) stack overflow in the Tenda AC8V4, firmware V16.03.34.06. The record lists no fixed version. Check Tenda's support page for new firmware, turn off remote administration, and replace the device if it no longer receives updates.

What's affected

• Product: Tenda AC8V4 router or access point and its firmware.
• Affected: firmware V16.03.34.06, as named in the record. Other builds may share the code, so do not assume a newer or older build is safe without checking the vendor.
• Fixed: the record names no fixed version. Check the vendor's download page, and read any release notes before you flash.
• Detail: the urls parameter handled by get_parentControl_list_Info is not bounded. The researcher ties it to the parental control save request.
• Vector: network reachable, no login and no user interaction, which is how it reaches 9.8.

How to check if you're exposed

Find the firmware version in the router's admin page, usually under a system status or firmware upgrade menu. Menu names differ by model, so use the vendor's manual if you cannot find it. Compare the version string with V16.03.34.06.

Then check whether the admin interface is reachable from the wrong places. From a machine outside your network, scan only your own public address.

nmap -Pn -p 80,443,8080 <your-public-ip>

Also check the router's settings for remote management, port forwarding and UPnP rules. If the web interface answers from the internet, treat the device as exposed. Look at the device logs if it keeps any, and for unexpected reboots or changed settings, which can indicate someone tried to use a flaw like this.

At a larger site, build a list of every Tenda device with its model and firmware so you know how many are affected.

What to do now

1. Check Tenda's support or download page for firmware newer than V16.03.34.06 for the AC8V4, and read its release notes before you flash.
2. Turn off remote administration and make sure no port forward or UPnP rule exposes the web interface.
3. Restrict the admin page to a small set of trusted internal addresses, and change the admin password to a long unique one.
4. Keep guests and untrusted devices on a separate network from the one that can reach the admin interface.
5. If no update exists or the product is out of support, plan to replace the device with a model that still receives security fixes.
6. If the device was exposed to the internet, check its settings for changes you did not make, reset it to factory defaults and reconfigure it from scratch.

Why it matters

The class is a memory safety bug. A web handler on the device reads a request value and copies it into a fixed size buffer without checking its length. When the value is longer than the buffer, the extra bytes overwrite neighbouring memory on the stack.

• CWE-120 is a buffer copy without checking the size of the input. The program copies caller supplied data into a fixed size buffer and trusts the length.

The weakness is tagged only as an unchecked copy, with no separate write class in the record. The effect on the device is memory corruption on the device, which can mean a crash or code execution with the privileges of the web service. Consumer and small office routers sit at the network edge and see every connection in and out, which makes a compromise valuable. They also tend to run old firmware for years because nobody owns the update task.

The published writeup is by an independent researcher, and the record does not say the vendor has responded. Tenda sells many models on shared codebases, so a bug in one build often points to the same pattern elsewhere. Reduce exposure first. The router's web interface should never face the internet, and the update question should be on your inventory.

Quick check

Sources

• Reference in the CVE record for CVE-2025-25667 (GitHub)

Last reviewed: 19 October 2026.