CVE-2025-51089 is a heap-based buffer overflow vulnerability in Tenda AC8V4 firmware version 16.03.34.06. The vulnerability occurs due to improper handling of the 'mac' argument in the /goform/GetParentControlInfo endpoint, allowing an attacker to cause a heap overflow. This can result in denial of service or potentially impact system availability and integrity. The CVSS v3.1 base score is 6.5 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. There are no known exploits in the wild and no vendor patch or advisory is currently available.

Successful exploitation of this heap overflow vulnerability can cause denial of service by crashing the device or potentially corrupting memory, impacting system integrity. There is no reported confidentiality impact. The vulnerability can be exploited remotely over the network without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict network access to the affected endpoint if possible and monitor for unusual device behavior. No official fix or temporary workaround has been published at this time.