Tenda AC8 Vulnerability Disclosures
Discovered and disclosed three CVEs in the Tenda AC8 V5.0 router: authentication bypass, command injection, and stack buffer overflow.
- CVE
- Firmware
- Embedded
Andrew Bellini is an IoT and hardware security researcher, educator, and Professional Engineer (P.Eng). He works on firmware reverse engineering and vulnerability discovery in IoT and embedded devices.
Andrew has presented at DEF CON IoT Village and has discovered and published multiple CVEs, including three vulnerabilities in the Tenda AC8 V5.0 router (authentication bypass, command injection, and stack buffer overflow). He also created PIPA (the Practical IoT Pentest Associate certification), a hands-on practical exam focused on real-world IoT penetration testing.
Andrew has authored courses on IoT and hardware hacking, assembly, and AI security. Outside of security, Andrew is a dad, enjoys the outdoors and riding his bicycle.
Discovered and disclosed three CVEs in the Tenda AC8 V5.0 router: authentication bypass, command injection, and stack buffer overflow.
Creator of the Practical IoT Pentest Associate certification. Hands-on practical exam with cloud-hosted labs.
Browser-based firmware reverse engineering platform with Ghidra, QEMU, and AI-assisted analysis. Built in React and FastAPI.
'Anyone Can Hack IoT: A Beginner's Guide to Hacking Your First IoT Device.' Intro to IoT pentesting, given at DEF CON 32.
Intro to IoT pentesting: UART, SPI, firmware extraction, and common weaknesses in consumer devices.
Assembly basics for reverse engineering and exploit development.
How modern AI systems work, for engineers who want to build with them.
Hands-on AI security: prompt injection, model manipulation, and adversarial techniques against LLMs and agents.
DEF CON 32 IoT Village
Anyone Can Hack IoT: A Beginner’s Guide to Hacking Your First IoT DeviceDEF CON Toronto
IoT Hacking Workshop
Writeups and research notes live on the blog.