CVE-2023-48194: Critical Memory Flaw in Tenda AC8v4 Router

CVE-2023-48194 is a critical (CVSS 9.8) out of bounds write in Tenda AC8v4 router firmware 16.03.34.09, reached through the set_client_qos function. I could not confirm a fixed firmware, so check the Tenda download page, update if a newer build exists and keep the admin interface off the internet.

What's affected

The record names the Tenda AC8v4 router and its firmware version 16.03.34.09. The NVD description says that due to sscanf and the last digit of a stack value being overwritten with a null byte, control over the gp register can be obtained after set_client_qos runs. The weakness is CWE-787 (Out-of-bounds Write).

The record scores it 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network reachable, low complexity, no account and no user action. The reference list holds a GitHub repository from the reporter and a Tenda download page. I did not use the repository for any detail beyond what the record says, and the Tenda page is a product download listing, not an advisory. No fixed version is named in the record, so none is stated here. The record does not flag the CVE as exploited in the wild.

Consumer router firmware often has a long gap between a report and a vendor update, and some models never get one. Plan for both outcomes.

How to check if you're exposed

Open the router's administration page from inside your network and read the firmware version on the system status or upgrade screen. Version 16.03.34.09 is the build named in the record. The model name AC8v4 is printed on the label under the device.

Then check exposure. Confirm that remote administration from the internet is off, and that the admin page is not reachable on the router's public address. You can test this from a mobile connection that is not on your home or office network, only for a router you own.

If you manage many sites, add the model and firmware version to your asset list so you can see which locations run it.

What to do now

1. Check the Tenda download page for the AC8v4 for a firmware build newer than 16.03.34.09, and read its notes.
2. Turn off remote management and any port forwarding to the router admin page.
3. Restrict the admin interface to a wired management host or a single trusted address if the router allows it.
4. Change the admin password to a unique one, and keep guest and IoT devices on a separate network.
5. If no update appears, plan to replace the device with a model that still gets security updates.

Why it matters

An out of bounds write means a program stores data outside the memory it set aside for it. On a router, memory corruption in a function that handles web requests can lead to a crash or, in the worst case, to code running on the device. Because the router sits on the network edge, a compromised one exposes every device behind it.

The practical gap here is visibility. Few teams track the firmware of small office routers the way they track application libraries, so they find out about an advisory late. Keeping devices in an inventory with model and firmware version is the first step. See the Safeguard Gold page for this CVE for the record.

Quick check

Sources

• Tenda download page referenced by the NVD record
• Reporter repository referenced by the NVD record
• NVD record for CVE-2023-48194

Last reviewed: 19 October 2026.