Ac6 CVE-2026-4960

Tenda AC6 firmware 15.03.05.16. Attacker must have authenticated access to POST endpoint /goform/WizardHandle. Remote exploitation by manipulating WANT/WANS parameters causes stack-based buffer overflow. Authentication required; unauthenticated remote exploitation not possible.

The CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-accessible exploitation with low complexity requiring low-privilege authentication and no user interaction, yielding high impact across all CIA triad components. The temporal metrics show proof-of-concept code exists (E:P) with no official remediation (RL:X) and reasonable report confidence (RC:R). Publicly available exploit code exists, significantly lowering the skill barrier for exploitation. The requirement for authentication (PR:L) provides minimal protection since many Tenda routers ship with default credentials or weak password policies. Real-world risk is elevated because consumer routers are rarely patched, often Internet-facing for remote management, and represent high-value targets for botnet recruitment or network pivoting. The combination of public exploit availability, low attack complexity, network accessibility, and the embedded device patch deployment challenge creates substantial practical risk despite the authentication requirement.

An authenticated attacker with low-privilege credentials (potentially obtained through credential stuffing, default passwords, or prior reconnaissance) connects to the Tenda AC6 router's web management interface over the network. The attacker crafts a malicious POST request to the /goform/WizardHandle endpoint with oversized WANT or WANS parameter values designed to overflow the stack buffer in the fromWizardHandle function. Publicly available exploit code exists demonstrating this technique, allowing the attacker to overwrite return addresses and execute arbitrary code with router firmware privileges, potentially installing persistent backdoors or incorporating the device into a botnet.