Tenda CVE-2026-4491

Authenticated attacker with user-level credentials on Tenda A18 Pro firmware version 02.03.02.28. Remotely exploitable via crafted request to /goform/SetIpMacBind endpoint manipulating argument list to trigger stack buffer overflow.

The CVSS v3.1 score of 8.8 (High) reflects the severe technical impact (complete compromise of confidentiality, integrity, and availability) and the network-based attack vector requiring only low-level authentication. The CVSS vector shows low attack complexity (AC:L), no user interaction required (UI:N), and confirmed exploit code availability (E:P). The publicly available proof-of-concept on GitHub significantly elevates real-world risk, lowering the barrier to exploitation for less sophisticated attackers. While the vulnerability requires authentication (PR:L), many Tenda routers use default credentials that are rarely changed by consumers, effectively reducing this barrier. The lack of remediation level information (RL:X) suggests no official patch is currently available from the vendor, further increasing urgency. This represents a genuine priority for organizations using affected Tenda devices, especially those exposed to untrusted networks or users, as the combination of public exploit code, network accessibility, and lack of vendor patch creates immediate exploitation risk.

An attacker on the local network or with VPN access authenticates to the Tenda A18 Pro router's web interface using default or compromised low-privilege credentials. The attacker then sends a specially crafted HTTP request to the /goform/SetIpMacBind endpoint with an oversized 'list' parameter value, triggering the stack-based buffer overflow in the fromSetIpMacBind function. Using the publicly available proof-of-concept exploit code from GitHub as a template, the attacker overwrites the return address on the stack to redirect execution to malicious shellcode, gaining complete control of the router to intercept traffic, pivot to internal networks, or establish persistent backdoor access.