CVE-2026-2138
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
A vulnerability was found in Tenda TX9 up to 22.03.02.10_multi. Affected is the function sub_42D03C of the file /goform/SetStaticRouteCfg. The manipulation of the argument list results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
Analysis
Remote code execution in Tenda TX9 firmware versions up to 22.03.02.10_multi through a buffer overflow in the static route configuration function allows authenticated attackers to achieve full system compromise. Public exploit code exists for this vulnerability, significantly increasing the risk of active exploitation. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify and inventory all Tenda TX9 devices running affected firmware versions; isolate internet-facing units from critical systems if possible. Within 7 days: Implement network access controls restricting administrative access to TX9 devices; monitor for suspicious routing configuration changes and unauthorized access attempts. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today