CVE-2026-4254 - Vulnerability Analysis

Overview

Tenda AC8 <= 16.03.50.11 contains a buffer overflow caused by improper handling of the argument local_2c in /goform/SysToolChangePwd HTTP Endpoint, letting remote attackers execute code, exploit requires crafted request.

Severity & Score

Impact

Remote attackers can execute arbitrary code, potentially leading to full system compromise.

Mitigation

Update to the latest version beyond 16.03.50.11.

References

• https://vuldb.com/?submit.771773
• https://www.tenda.com.cn/
• https://github.com/digitalandrew/tenda_ac8_v5/blob/main/CVE_Report_Tenda_AC8_SysToolChangePwd_BOF.md
• https://vuldb.com/?ctiid.351212
• https://vuldb.com/?id.351212

Social Media Activity(1 post)

Offensive Sequence

@offseq

Mar 17, 2026

🚨 CRITICAL: CVE-2026-4254 in Tenda AC8 (fw ≤16.03.50.11) enables remote stack buffer overflow via /goform/SysToolChangePwd. Public exploit out — isolate & monitor! No patch yet. https://radar.offseq.com/threat/cve-2026-4254-stack-based-buffer-overflow-in-tenda-501e8b3e #OffSeq #CVE20264254 #RouterSecurity #Vuln

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner