Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-4254
9.8 CRITICAL
- CVSS version: 3.1
- Attack vector (AV):
- Attack complexity (AC):
- Privileges required (PR):
- User interaction (UI):
- Scope (S):
- Confidentiality impact (C):
- Integrity impact (I):
- Availability impact (A):
Activity log
- Created suggestion
Tenda AC8 HTTP Endpoint SysToolChangePwd doSystemCmd stack-based overflow
A weakness has been identified in Tenda AC8 up to 16.03.50.11. This vulnerability affects the function doSystemCmd of the file /goform/SysToolChangePwd of the component HTTP Endpoint. This manipulation of the argument local_2c causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
References
-
VDB-351212 | Tenda AC8 HTTP Endpoint SysToolChangePwd doSystemCmd stack-based overflow vdb-entrytechnical-description
-
-
Submit #771773 | Tenda AC8 V5 V16.03.50.11 Buffer Overflow third-party-advisory
-
https://www.tenda.com.cn/ product
Affected products
AC8
- ==16.03.50.5
- ==16.03.50.9
- ==16.03.50.4
- ==16.03.50.1
- ==16.03.50.3
- ==16.03.50.10
- ==16.03.50.6
- ==16.03.50.7
- ==16.03.50.0
- ==16.03.50.8
- ==16.03.50.11
- ==16.03.50.2
Matching in nixpkgs
pkgs.spotify
Play music from the Spotify music service
-
nixos-unstable 1.2.82.428.g0ac8be2b
- nixpkgs-unstable 1.2.82.428.g0ac8be2b
- nixos-unstable-small 1.2.82.428.g0ac8be2b
pkgs.vimPlugins.nvim-treesitter-parsers.strace
Tree-sitter grammar for strace
-
nixos-unstable 0.0.0+rev=ac874dd
- nixpkgs-unstable 0.0.0+rev=ac874dd
- nixos-unstable-small 0.0.0+rev=ac874dd
Package maintainers
-
@ftrvxmtrx Sigrid Solveig Haflínudóttir <ftrvxmtrx@gmail.com>
-
@Ma27 Maximilian Bosch <maximilian@mbosch.me>
-
@timokau Timo Kaufmann <timokau@zoho.com>