CVE-2025-4368 is a high severity (CVSS 8.8) buffer overflow in the Tenda AC8 router, firmware 16.03.34.06, in the formGetRouterStatus function of /goform/MtuSetMacWan. The exploit is described as public. No fixed firmware is named, so restrict admin access and check Tenda's support pages.
What's affected
The record lists Tenda AC8 firmware 16.03.34.06. The affected function is formGetRouterStatus in the file /goform/MtuSetMacWan, and the manipulated argument is shareSpeed. The description says the attack can be launched remotely and the exploit has been disclosed.
No fixed version is named, and I could not confirm one from a vendor advisory. Check Tenda's support pages for any firmware newer than 16.03.34.06 for the AC8.
The vector lists network access, low complexity and low privileges, so a login on the router is part of the scoring.
How to check if you're exposed
Open the router admin page and read the firmware version under system status or upgrade. A match with 16.03.34.06 means the record applies.
Check that remote management is disabled and that no port forward points at the router's own web port. From a guest network, test whether the admin address answers.
If you manage several sites, list every AC8 from your asset or DHCP records. Home office routers supplied by staff are easy to miss in inventories.
What to do now
- Find every Tenda AC8 and read its firmware version.
- Look for a newer firmware on the Tenda support page and apply it if one is listed.
- Replace the device if the maker has no fix and it protects sensitive systems.
- Disable remote management and set a strong unique admin password.
- Separate guest Wi-Fi from the admin interface.
- Review the router configuration for unfamiliar DNS or port forward entries.
Why it matters
The class is a buffer overflow, CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Classic Buffer Overflow). The function copies a value from a request into memory of a fixed size without a proper length check. The record names the argument shareSpeed, which suggests a field that was assumed to hold a short number or word.
Memory corruption on a router can mean a crash, which affects availability, or control of the device, which affects everything behind it. Embedded firmware often lacks the exploit mitigations that modern desktop systems have. The score of 8.8 reflects high impact on confidentiality, integrity and availability.
The record says a public exploit exists, but does not say the flaw is exploited in the wild, and the CVE is not on the CISA Known Exploited Vulnerabilities list. A public write up lowers the effort needed, so the practical answer is to control who can reach the admin page.
Quick check
Do I need to log in for the flaw to work?
The vector lists low privileges required, so a login on the router is part of the scoring. Weak or default passwords make that condition easy to meet.
Is there a patched firmware?
The record does not name one. Check the Tenda support page for the AC8 and replace the device if nothing newer exists.
Sources
- Gold entry for CVE-2025-4368
- Public write-up referenced by the NVD record
- VulDB entry 307488 referenced by the NVD record
- Tenda site referenced by the NVD record
Last reviewed: 18 October 2026.
