The vulnerability CVE-2026-8234 affects the EFM ipTIME A8004T router firmware version 14.18.2. It is a stack-based buffer overflow triggered by improper handling of the security_5g parameter in the /goform/WifiBasicSet endpoint. This flaw allows remote attackers to potentially execute arbitrary code or cause denial of service due to the overflow. The attack vector is network-based with no user interaction required and low complexity, but it requires some privileges. The vendor has not issued any patch or official remediation, and the vulnerability is publicly known.

Successful exploitation of this vulnerability could lead to remote code execution or denial of service on the affected device. Given the high CVSS score (8.7), the impact on confidentiality, integrity, and availability is high. The vulnerability can be triggered remotely without user interaction, increasing the risk of exploitation. However, there are no confirmed reports of active exploitation in the wild at this time.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded to the disclosure and no fixes have been published, users should consider limiting network exposure of the affected device, such as restricting access to the management interface from untrusted networks. Monitor vendor channels for any future updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.