A critical buffer overflow vulnerability in Tenda AC8 firmware version 16.03.33.05 allows remote attackers to cause a denial of service or potentially achieve arbitrary code execution.

The vulnerability is a stack-based buffer overflow located in the fromSetWifiGusetBasic function within the httpd service. An authenticated attacker can supply an excessively long string to the shareSpeed parameter, which is processed using an unsafe strcpy operation, leading to memory corruption.

Successful exploitation of this flaw poses a severe risk to network availability and security. Because the vulnerability resides in the web management interface, an attacker could crash the device, leading to a denial of service for all connected clients, or leverage the memory corruption to execute arbitrary code with the privileges of the httpd process. Given the CVSS score of 8.8, this vulnerability represents a high-severity threat to organizational infrastructure.

Immediate Action: There is currently no vendor-supplied patch available; administrators should restrict access to the router's web management interface to trusted internal segments only.

Proactive Monitoring: Monitor device logs and network traffic for repeated POST requests to the /goform/WifiGuestSet endpoint, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or equivalent network inspection tool to filter or block HTTP requests containing abnormally large values in the shareSpeed parameter.

Public Exploit Available: Yes, a proof-of-concept exploit is available via the researcher's published technical write-up on GitHub.

Given the availability of a functional proof-of-concept and the potential for remote code execution, this vulnerability should be treated with high priority. Organizations using the affected Tenda AC8 firmware should immediately restrict administrative access to the web interface and monitor for vendor updates to address the underlying memory safety flaw.