A critical stack-based buffer overflow vulnerability in Tenda AC8V4 routers allows unauthenticated attackers to execute arbitrary code.

The vulnerability exists within the /goform/saveParentControlInfo endpoint due to improper bounds checking on the time argument. This flaw allows an unauthenticated attacker to trigger a stack-based buffer overflow, potentially leading to remote code execution or system instability.

The CVSS score of 8.6 classifies this as a High severity issue, reflecting the significant risk of full device compromise. Successful exploitation could allow an attacker to gain persistent access to the network, intercept traffic, or pivot to internal assets, resulting in severe data breaches and operational downtime.

Immediate Action: Since a vendor-supplied patch is currently unknown, restrict access to the web management interface of the Tenda AC8V4 device to trusted internal networks only.

Proactive Monitoring: Review device access logs for unusual traffic patterns directed at the /goform/saveParentControlInfo endpoint or repeated failed authentication attempts.

Compensating Controls: Deploy a network-level firewall or Web Application Firewall (WAF) to block unauthorized requests targeting the vulnerable management interface.

Public Exploit Available: Yes, a proof of concept is available via the researcher write-up linked in the CVE references.

Given the ease of exploitability and the lack of a confirmed vendor patch, immediate network segmentation is required to shield the affected hardware. Administrators should isolate the management interface of the Tenda AC8V4 from the public internet and continue monitoring vendor channels for firmware updates that address this buffer overflow.