Tenda AC8v4 Firmware V16.03.34.09 - Out-of-bounds Write via set_client_qos
Vulnerability in Tenda AC8v4 .V16.03.34.09 due to sscanf and the last digit of s8 being overwritten with \x0. After executing set_client_qos, control over the gp register can be obtained.