Which versions of Tenda are affected by CVE-2026-4567?

A critical unauthenticated remote code execution vulnerability affects Tenda A15 routers with no patch currently available.

Is there a public PoC exploit available for CVE-2026-4567?

Yes, a public proof-of-concept exploit is available for CVE-2026-4567. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-4567?

Within 24 hours: Inventory all Tenda A15 routers in your environment and identify those running firmware 15.13.07.13; disable internet-facing access to the /cgi-bin/UploadCfg endpoint immediately via firewall rules; alert relevant stakeholders. Within 7 days: Implement network segmentation to isolate affected routers; deploy WAF rules to block requests to vulnerable endpoints; establish 24/7 monitoring for exploitation attempts. Within 30 days: Plan replacement or upgrade to alternative network equipment from vendors with active security support; if retention is necessary, maintain strict air-gapped or VPN-only access controls.

Tenda CVE-2026-4567

Q: What is the CVSS score of CVE-2026-4567?

CVE-2026-4567 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-14349 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-23 VulDB

GHSA-xhj3-xwvq-rwxj

Buffer Overflow Tenda Stack Overflow

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 02, 2026 - 12:11 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 02:30 euvd

EUVD-2026-14349

Analysis Generated

Mar 23, 2026 - 02:30 vuln.today

CVE Published

Mar 23, 2026 - 01:30 nvd

HIGH 8.9

DescriptionCVE.org

A vulnerability has been found in Tenda A15 15.13.07.13. The impacted element is the function UploadCfg of the file /cgi-bin/UploadCfg. The manipulation of the argument File leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Articles & Coverage 1

vuln.today Threat Landscape 23/03-30/03/2026: Supply Chain Attacks and Auth Failures Surge Mar 30, 2026

AnalysisAI

Stack-based buffer overflow in Tenda A15 router firmware version 15.13.07.13 allows unauthenticated remote attackers to achieve complete system compromise through a malicious file upload to the UploadCfg function. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and can be executed over the network with trivial complexity.

Technical ContextAI

The vulnerability affects Tenda A15 wireless routers (CPE: cpe:2.3:a:tenda:a15:*:*:*:*:*:*:*:*) running firmware version 15.13.07.13. The root cause is classified as CWE-121 (Stack-based Buffer Overflow), occurring in the UploadCfg CGI binary handler responsible for configuration file uploads. When processing the File parameter, the function fails to properly validate input length before copying data to a fixed-size stack buffer, allowing an attacker to overwrite adjacent memory regions including the return address. This class of vulnerability is particularly dangerous in embedded devices like routers, which often run with elevated privileges and lack modern exploit mitigations like ASLR, DEP, or stack canaries.

RemediationAI

Users should immediately check the Tenda official website (https://www.tenda.com.cn/) for firmware updates addressing this vulnerability and upgrade to a patched version if available, though the CVSS temporal metrics (RL:X) indicate remediation level information is currently unavailable. Until official patches are released and deployed, implement network-level mitigations including disabling remote administration access to the router's web interface, restricting access to the management interface to trusted internal networks only via firewall rules, and placing affected devices behind additional network security controls. Consider replacing the device with alternative hardware if Tenda does not release timely security updates, as the public availability of exploit code creates immediate risk. Monitor the VulDB entries and GitHub issue tracker for updates on patch availability.