EUVD-2026-45942
GHSA-f73c-56vj-cw8p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router httpd web interface
-
DeliveryAuthenticate with valid/default credentials
-
ExploitSend crafted POST to /goform/AdvSetLanip
-
ExecutionOverflow stack buffer via oversized GetValue/SetValue
-
PersistOverwrite saved return address
-
ImpactExecute code or crash httpd on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the router's httpd web-management interface and a valid low-privilege authenticated session (CVSS PR:L), obtained via legitimate, default, or weak credentials; the attacker then sends a request to the /goform/AdvSetLanip endpoint with an overlong GetValue or SetValue parameter that the fromAdvSetLanip function copies into a fixed stack buffer. Limiting factors: the attack is confined to devices running the affected 16.03.10.09_multi_TDE01 firmware, requires that the web interface be reachable from the attacker (LAN by default, or WAN only if remote management is enabled), and requires authentication - it is not exploitable fully unauthenticated against a default-hardened configuration. No user interaction is required (UI:N), and attack complexity is low (AC:L). |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates a network-reachable, low-complexity attack requiring low privileges (PR:L - i.e., the router's web interface authentication) and no user interaction, with high impact across all three security properties, yielding a 7.4 score. The 'E:P' exploit-maturity flag plus the public GitHub advisory confirm a proof-of-concept exists, raising practical risk above a theoretical finding. However, this is NOT in CISA KEV and no active exploitation is confirmed, so it should be treated as a POC-available issue rather than a confirmed campaign. No EPSS score was provided in the input, so widespread automated exploitation probability cannot be quantified. A key nuance: PR:L means the attacker must first hold valid web-UI credentials (or the device must use default/weak credentials, common for SOHO routers) - this meaningfully limits mass unauthenticated exploitation, so the realistic threat is strongest where these routers are exposed to the internet with weak or default logins. |
| Exploit ScenarioDerived | An attacker who can reach the router's web interface - either on the LAN or via an internet-exposed management port - and holds valid or default credentials submits a crafted POST to /goform/AdvSetLanip with an oversized GetValue or SetValue argument. The overflow overwrites the stack return address in the httpd process, crashing the service (denial of service) or, with a tailored payload, executing attacker-supplied code on the router. Public POC/advisory material lowers the effort required to reproduce this attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 20, 2026
Stack-based buffer overflow in the Tenda AC10 router (firmware 16.03.10.09_multi_TDE01) allows a remote, authenticated attacker to corrupt memory in the httpd/netctrl web service by supplying oversized GetValue/SetValue arguments to the fromAdvSetLanip handler at /goform/AdvSetLanip, potentially achieving code execution or a device crash. Publicly available exploit code exists (published via VulDB and a GitHub advisory), but there is no public exploit identified as actively exploited in the wild. The CVSS 4.0 base score of 7.4 reflects high confidentiality, integrity, and availability impact combined with a low-privilege requirement.
Earlier versions of this analysis (1)
Stack-based buffer overflow in the Tenda AC10 router (firmware 16.03.10.09_multi_TDE01) lets remote attackers corrupt memory via the fromAdvSetLanip handler in the httpd/netctrl component, reachable through /goform/AdvSetLanip. By supplying oversized GetValue/SetValue arguments an attacker can overwrite the stack and likely achieve arbitrary code execution on the device. Publicly available exploit code exists (published by VulDB and a GitHub advisory), though there is no public exploit identified as being used in active attacks and the flaw is not in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis - no fixed firmware version is cited in the available data, and Tenda AC10 devices in this class frequently reach end-of-support. As compensating controls: disable remote (WAN-side) web administration so /goform endpoints are not reachable from the internet, and restrict access to the LAN management interface to trusted hosts only. Change default administrator credentials to strong unique passwords, since exploitation requires the low-privilege web session (PR:L) that weak credentials would hand to an attacker. Where feasible, place the router's management plane behind a firewall/VLAN and monitor for repeated malformed POST requests to /goform/AdvSetLanip. Consult the vendor at https://www.tenda.com.cn/ for updated firmware and the advisory at https://github.com/teiwiet/tenda-ac10-vulnerabilities/blob/main/advisory-fromAdvSetLanip.md; note that disabling remote management removes convenient off-site administration, the primary trade-off of that control. If no patch becomes available and the device is internet-exposed, replacement with a supported router is the durable fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the embedded HTTP server (httpd) and its network-control module (netctrl) running on the Tenda AC10 SOHO Wi-Fi router. The /goform/AdvSetLanip endpoint maps to the fromAdvSetLanip C function, which processes the advanced LAN IP configuration form. Per CWE-121 (Stack-based Buffer Overflow), the root cause is copying attacker-controlled GetValue/SetValue parameter data into a fixed-size stack buffer without bounds validation (typically an unchecked strcpy/sprintf/memcpy pattern common in Tenda goform handlers). Overflowing the buffer overwrites adjacent stack memory including the saved return address; on the MIPS/ARM architecture typical of these devices, without stack protections this can redirect execution flow. The CPE cpe:2.3:a:tenda:ac10 confirms the Tenda AC10 as the affected product.
Know when Ac10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Web endpoint is network-reachable with low complexity but requires an authenticated web session (PR:L); a stack overflow in httpd threatens full confidentiality, integrity, and availability.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in Tenda AC10 16.03.10.09_multi_TDE01. This issue affects the function fromAdvSetLanip of the file /goform/AdvSetLanip of the component httpd/netctrl. The manipulation of the argument GetValue/SetValue results in stack-based buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used.
Executive ViewAI
The Tenda AC10 router (firmware 16.03.10.09_multi_TDE01) contains a remotely exploitable vulnerability (CVE-2026-16248) that could allow authenticated attackers to execute code or crash network infrastructure. Publicly available exploit code exists, creating immediate risk for organizations using this router model. Administrative credential security and access controls are critical interim protections until vendor patches become available.
No vendor-released patch identified at time of analysis. Interim mitigations include: enforce strong administrative credential policies with regular resets; restrict network access to the router's web interface to authorized management subnets only; disable remote management access where operationally feasible; monitor administrative access logs for suspicious patterns targeting /goform/AdvSetLanip; implement input validation rules upstream if WAF is deployed; physically isolate devices handling critical network functions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Authentication bypass in Tenda AC10 firmware 16.03.10.09_multi_TDE01 allows unauthenticated remote attackers to circumve
Tenda AC10 router firmware 16.03.10.10_multi_TDE01 exposes a hard-coded RSA 2048-bit private key in the world-readable f
Stack-based buffer overflow in Tenda AC10 router firmware version 16.03.10.10_multi_TDE01 allows authenticated remote at
Stack-based buffer overflow in Tenda AC10 router firmware 16.03.10.10_multi_TDE01 allows authenticated remote attackers
OS command injection in Tenda AC10 firmware 16.03.10.10_multi_TDE01 allows authenticated remote attackers to execute arb
Exploit-DB