Which versions of Tenda are affected by CVE-2026-4960?

Tenda AC6 routers running firmware 15.03.05.16 are vulnerable to remote code execution that allows authenticated attackers to gain full control of the device, compromising network security and…

Is there a public PoC exploit available for CVE-2026-4960?

Yes, a public proof-of-concept exploit is available for CVE-2026-4960. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4960?

Within 24 hours: Identify all Tenda AC6 routers in your environment and confirm firmware version via administrative interface; immediately isolate any devices running version 15.03.05.16 from production networks or restrict administrative access to trusted internal networks only. Within 7 days: Contact Tenda support to confirm patch timeline for version 15.03.05.16; implement network-based access controls to block unauthorized POST requests to /goform/WizardHandle; evaluate replacement with alternative router models from vendors with active security support. Within 30 days: Develop and execute a device replacement or firmware upgrade plan once patches are released; conduct network forensics on isolated devices to detect any signs of prior exploitation.

Tenda CVE-2026-4960

Q: What is the CVSS score of CVE-2026-4960?

CVE-2026-4960 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16723 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-27 VulDB

GHSA-mcgx-8v57-hq28

Buffer Overflow Stack Overflow Tenda

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Mar 31, 2026 - 20:58 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 16:45 euvd

EUVD-2026-16723

Analysis Generated

Mar 27, 2026 - 16:45 vuln.today

CVE Published

Mar 27, 2026 - 16:09 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was determined in Tenda AC6 15.03.05.16. Affected is the function fromWizardHandle of the file /goform/WizardHandle of the component POST Request Handler. Executing a manipulation of the argument WANT/WANS can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

AnalysisAI

Stack-based buffer overflow in Tenda AC6 router firmware version 15.03.05.16 enables authenticated remote attackers to achieve code execution with high impact to confidentiality, integrity, and availability. The vulnerability resides in the fromWizardHandle function handling POST requests to /goform/WizardHandle, exploitable by manipulating WANT/WANS parameters. Publicly available exploit code exists, demonstrating the attack technique via a detailed proof-of-concept published on Notion. With a CVSS score of 8.8 and low attack complexity, this represents a significant risk to affected devices despite requiring low-privilege authentication.

Technical ContextAI

The vulnerability affects Tenda AC6 wireless router firmware (CPE: cpe:2.3:a:tenda:ac6:*:*:*:*:*:*:*:*), specifically version 15.03.05.16. The root cause is CWE-121 (Stack-based Buffer Overflow) in the fromWizardHandle function within the /goform/WizardHandle endpoint that processes POST requests during router configuration. When processing the WANT or WANS parameters during the setup wizard workflow, insufficient bounds checking allows attacker-controlled input to overflow a stack-allocated buffer. This class of vulnerability can overwrite return addresses or function pointers on the call stack, enabling control of program execution flow. The issue is endemic to embedded device firmware that often lacks modern memory protection mechanisms like stack canaries, ASLR, or DEP.

RemediationAI

No vendor-released patch identified at time of analysis based on the available reference data. The CVSS remediation level indicator (RL:X) confirms no official fix is available. Until Tenda releases updated firmware addressing CVE-2026-4960, administrators should implement compensating controls including disabling remote management interfaces to prevent network-based exploitation, restricting administrative access to trusted IP ranges only, changing default credentials to strong unique passwords, and placing affected routers behind additional network segmentation. Monitor VulDB tracking pages at https://vuldb.com/?id.353837 and the vendor site at https://www.tenda.com.cn/ for future security updates. Consider replacing affected devices with alternative products if vendor support appears abandoned.