Tenda AC8 Vulnerability Disclosures
Discovered and disclosed three CVEs in the Tenda AC8 V5.0 router: authentication bypass, command injection, and stack buffer overflow.
- CVE
- Firmware
- Embedded
Andrew Bellini is an IoT and hardware security researcher, educator, and Professional Engineer (P.Eng). He works on firmware reverse engineering and vulnerability discovery in IoT and embedded devices.
Andrew has presented at DEF CON IoT Village and has discovered and published multiple CVEs, including three vulnerabilities in the Tenda AC8 V5.0 router (authentication bypass, command injection, and stack buffer overflow). He also created PIPA (the Practical IoT Pentest Associate certification), a hands-on practical exam focused on real-world IoT penetration testing.
Andrew has authored courses on IoT and hardware hacking, assembly, and AI security. Outside of security, Andrew is a dad, enjoys the outdoors and riding his bicycle.
Discovered and disclosed three CVEs in the Tenda AC8 V5.0 router: authentication bypass, command injection, and stack buffer overflow.
Creator of the Practical IoT Pentest Associate certification. Hands-on practical exam with cloud-hosted labs.
Covers electrical fundamentals, multimeters and logic analyzers, UART shells, SPI firmware extraction, and firmware reverse engineering. 11 sections, 80 lessons.
'Anyone Can Hack IoT: A Beginner's Guide to Hacking Your First IoT Device.' Intro to IoT pentesting, given at DEF CON 32.
Intro to IoT pentesting: UART, SPI, firmware extraction, and common weaknesses in consumer devices.
Assembly basics for reverse engineering and exploit development.
How modern AI systems work, for engineers who want to build with them.
Hands-on AI security: prompt injection, model manipulation, and adversarial techniques against LLMs and agents.
DEF CON 34 IoT Village
Anyone Can Hack IoT (Even Easier Now): A Beginner's Guide to AI Augmented IoT Hacking
Full schedule, plus 4 All About UART workshops →DEF CON 32 IoT Village
Anyone Can Hack IoT: A Beginner’s Guide to Hacking Your First IoT DeviceDEF CON Toronto
IoT Hacking Workshop
Writeups and research notes live on the blog.