EUVD-2026-58574
GHSA-xq4w-6936-w8h4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable web endpoint, PR:L per CVSS 4.0 input; stack overflow yields full RCE with C/I/A:H; no scope change as subsequent-system impact is N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. This vulnerability affects the function set_wl_guest_iplist of the file /goform/WifiGuestSet of the component httpd web management interface. This manipulation of the argument shareSpeed causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
AnalysisAI
Stack-based buffer overflow in Tenda AC1206 firmware 15.03.06.23_multi_TD01 exposes the router's web management interface to remote code execution via a crafted guest WiFi configuration request. The vulnerable function set_wl_guest_iplist at the /goform/WifiGuestSet endpoint fails to validate the length of the shareSpeed argument before copying it onto a fixed-size stack buffer, enabling an attacker with low-privilege router access to overwrite the return address and seize control of the httpd process - which typically runs as root on embedded router firmware. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to the Tenda AC1206 httpd web management interface and authentication at a low-privilege level, as reflected by the CVSS 4.0 PR:L metric - unauthenticated exploitation is not confirmed from available data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 7.4 and conveys a network-reachable, low-complexity exploit requiring only low-privilege authentication with no user interaction, yielding full confidentiality, integrity, and availability impact to the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with low-privilege credentials to the Tenda AC1206 web interface - obtained via default credentials, brute force, or credential reuse - sends a crafted HTTP POST request to `/goform/WifiGuestSet` with an oversized `shareSpeed` value. The `set_wl_guest_iplist` function copies the value into a fixed stack buffer, overwriting the saved return address; upon function return, execution redirects to attacker-controlled code running as the `httpd` process (typically root). … |
| Remediation | Check https://www.tenda.com.cn/ for a firmware update addressing the stack overflow in the guest WiFi configuration handler; no patched firmware version number has been independently confirmed in the available references, so 'Patch available per vendor advisory' cannot be stated - this is an absence of confirmed fix data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct inventory of all Tenda AC1206 devices across your infrastructure, confirm which devices run the vulnerable firmware version 15.03.06.23_multi_TD01, and implement emergency firewall rules restricting access to the web management interface from untrusted network segments or low-privilege users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today