CVE-2024-57703 is a critical severity stack overflow flaw (CVSS 9.8) in Tenda AC8v4 firmware V16.03.34.06. The schedEndTime parameter of the setSchedWifi function is mishandled. We could not confirm a fixed version, so check Tenda's download page for newer firmware and limit access to the admin interface.
What's affected
The record says Tenda AC8v4 V16.03.34.06 contains a stack overflow via the schedEndTime parameter in the setSchedWifi function. That function is the scheduled Wi-Fi handler at /goform/openSchedWifi, and the parameter carries the end time of a Wi-Fi schedule.
The same researcher published a series of Tenda router write-ups at the same time, including several for the AC18. The write-up links to Tenda's firmware download page for the affected version. No Tenda advisory is linked, so a fixed version is not confirmed. Treat V16.03.34.06 as affected, and check Tenda's download page for any newer firmware for your exact hardware revision. Tenda sells several variants under similar names, so match the model and hardware version printed on the router label before you download anything.
How to check if you're exposed
Open the router's admin page and read the firmware version on the system status or upgrade screen. If it reads V16.03.34.06, you have the version in the record.
Then check exposure.
- Is remote web management enabled? On many routers this is a single checkbox. Turn it off unless you have a reason.
- Which devices can reach the admin page from the inside? Guest devices and smart home gadgets on the main network can all send requests to it.
- Is the admin password still the default or a weak one?
The vector in the record shows network access with no privileges required. The write-ups for this firmware show requests sent to the router's web interface, and some include a session cookie, so whether a login is needed may depend on the version. Do not treat the login page as a safe barrier.
What to do now
- Check Tenda's download page for the AC8v4 and install firmware newer than V16.03.34.06 if it exists for your hardware revision.
- Turn off remote web management so the admin interface cannot be reached from the internet.
- Set a long, unique admin password and a strong Wi-Fi password.
- Put guests and smart devices on a separate guest network, if the router allows it.
- Replace the router if Tenda has stopped issuing firmware for it, since a model with no updates will not get a fix for this.
- Check the router now and then for settings you did not make, such as DNS servers or port forwards.
Why it matters
The record classes this as CWE-120 and CWE-787. A stack based buffer overflow happens when code copies input of unknown length into a fixed size area on the stack. The researcher's write-up describes a strcpy of a request value into a 25 byte area, with no length check. It shows the start time parameter in its example, while the record names the end time, so both schedule fields may be involved. Extra bytes spill over into neighbouring data and, in the worst case, into the saved return address. The usual result is a crash and a reboot of the router. With more work, an attacker may take control of execution, as the write-ups for this firmware family describe.
The vector in the record shows network access, low complexity and no privileges, with high impact on confidentiality, integrity and availability, so the score is 9.8. The KEV flag in the record is false. Consumer routers repeat this class of bug often, because the web handlers are written in C, parse many parameters and rarely get a security review. The practical advice is to keep the admin interface off the internet, update when firmware exists and replace devices that no longer get updates.
Quick check
Which parameter is affected by CVE-2024-57703?
The record names the schedEndTime parameter in the setSchedWifi function.
Is there a fixed firmware?
We could not confirm one from the sources. Check Tenda's download page for your model and ask Tenda support if nothing newer is listed.
Sources
Last reviewed: 19 October 2026.
