Which versions of Tenda AC10 are affected by CVE-2026-16248?

The Tenda AC10 router (firmware 16.03.10.09_multi_TDE01) contains a remotely exploitable vulnerability (CVE-2026-16248) that could allow authenticated attackers to execute code or crash network…

Is there a public PoC exploit available for CVE-2026-16248?

Yes, a public proof-of-concept exploit is available for CVE-2026-16248. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-16248?

Within 24 hours, audit all Tenda AC10 router administrative access logs for suspicious activity targeting /goform/AdvSetLanip and immediately reset all administrative credentials to strong, unique passwords. Within 7 days, implement network segmentation to restrict web-based administrative access to authorized management networks only and disable remote management if not required for operations. Within 30 days, contact Tenda support regarding firmware upgrades beyond 16.03.10.09_multi_TDE01, evaluate replacement with actively patched router vendors, and document all compensating controls for audit compliance.

Tenda AC10 CVE-2026-16248

Q: What is the CVSS score of CVE-2026-16248?

CVE-2026-16248 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-45942 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-20 VulDB

GHSA-f73c-56vj-cw8p

Tenda Buffer Overflow Stack Overflow Ac10

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Web endpoint is network-reachable with low complexity but requires an authenticated web session (PR:L); a stack overflow in httpd threatens full confidentiality, integrity, and availability.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 20, 2026 - 13:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 20, 2026 - 13:23 vuln.today

cvss_changed

CVSS changed

Jul 20, 2026 - 13:23 NVD

8.7 (HIGH) 7.4 (HIGH)

Analysis Generated

Jul 20, 2026 - 13:21 vuln.today

CVE Published

Jul 20, 2026 - 12:45 cve.org

HIGH 8.7

DescriptionCVE.org

A vulnerability was found in Tenda AC10 16.03.10.09_multi_TDE01. This issue affects the function fromAdvSetLanip of the file /goform/AdvSetLanip of the component httpd/netctrl. The manipulation of the argument GetValue/SetValue results in stack-based buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used.

AnalysisAI

Stack-based buffer overflow in the Tenda AC10 router (firmware 16.03.10.09_multi_TDE01) allows a remote, authenticated attacker to corrupt memory in the httpd/netctrl web service by supplying oversized GetValue/SetValue arguments to the fromAdvSetLanip handler at /goform/AdvSetLanip, potentially achieving code execution or a device crash. Publicly available exploit code exists (published via VulDB and a GitHub advisory), but there is no public exploit identified as actively exploited in the wild. The CVSS 4.0 base score of 7.4 reflects high confidentiality, integrity, and availability impact combined with a low-privilege requirement.

Technical ContextAI

The affected component is the embedded HTTP server (httpd) and its network-control module (netctrl) running on the Tenda AC10 SOHO Wi-Fi router. The /goform/AdvSetLanip endpoint maps to the fromAdvSetLanip C function, which processes the advanced LAN IP configuration form. Per CWE-121 (Stack-based Buffer Overflow), the root cause is copying attacker-controlled GetValue/SetValue parameter data into a fixed-size stack buffer without bounds validation (typically an unchecked strcpy/sprintf/memcpy pattern common in Tenda goform handlers). Overflowing the buffer overwrites adjacent stack memory including the saved return address; on the MIPS/ARM architecture typical of these devices, without stack protections this can redirect execution flow. The CPE cpe:2.3:a:tenda:ac10 confirms the Tenda AC10 as the affected product.

RemediationAI

No vendor-released patch identified at time of analysis - no fixed firmware version is cited in the available data, and Tenda AC10 devices in this class frequently reach end-of-support. As compensating controls: disable remote (WAN-side) web administration so /goform endpoints are not reachable from the internet, and restrict access to the LAN management interface to trusted hosts only. Change default administrator credentials to strong unique passwords, since exploitation requires the low-privilege web session (PR:L) that weak credentials would hand to an attacker. Where feasible, place the router's management plane behind a firewall/VLAN and monitor for repeated malformed POST requests to /goform/AdvSetLanip. Consult the vendor at https://www.tenda.com.cn/ for updated firmware and the advisory at https://github.com/teiwiet/tenda-ac10-vulnerabilities/blob/main/advisory-fromAdvSetLanip.md; note that disabling remote management removes convenient off-site administration, the primary trade-off of that control. If no patch becomes available and the device is internet-exposed, replacement with a supported router is the durable fix.