What is the CVSS score of CVE-2026-2876?

CVE-2026-2876 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of A18 Firmware are affected by CVE-2026-2876?

A HIGH severity vulnerability (CVE-2026-2876, CVSS 8.8) has been identified in Tenda A18 wireless routers that could allow unauthorized remote access or command execution through the MAC filter…

How to fix or mitigate CVE-2026-2876?

Within 24 hours: Inventory all Tenda A18 15.13.07.13 devices in your network and isolate affected units from critical systems where possible. Within 7 days: Implement network segmentation to restrict administrative access to the vulnerable devices and apply the compensating controls listed below. Within 30 days: Contact Tenda for patch availability, evaluate device replacement or upgrade, and confirm all instances have been remediated or decommissioned.

A18 Firmware CVE-2026-2876

HIGH

Buffer Overflow (CWE-119)

2026-02-21 cna@vuldb.com

Buffer Overflow Stack Overflow A18 Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

CVE Published

Feb 21, 2026 - 18:16 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was determined in Tenda A18 15.13.07.13. This affects the function parse_macfilter_rule of the file /goform/setBlackRule. This manipulation of the argument deviceList causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Stack overflow in Tenda A18 firmware version 15.13.07.13 allows remote attackers with low privileges to achieve complete system compromise through a malformed deviceList parameter in the /goform/setBlackRule endpoint. Public exploit code is available and the vulnerability remains unpatched, creating significant risk for affected devices.

Technical ContextAI

Classified as CWE-119 (Buffer Overflow). Affects A18 Firmware. A vulnerability was determined in Tenda A18 15.13.07.13. This affects the function parse_macfilter_rule of the file /goform/setBlackRule. This manipulation of the argument deviceList causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

RemediationAI

Monitor vendor advisories for a patch. Enable ASLR, DEP/NX, and stack canaries where possible. Restrict network access to the affected service where possible.