Which versions of Tenda are affected by CVE-2026-4961?

Tenda AC6 routers running firmware 15.03.05.16 contain a critical remote code execution vulnerability enabling attackers with low-level authentication to gain full control of affected devices.

Is there a public PoC exploit available for CVE-2026-4961?

Yes, a public proof-of-concept exploit is available for CVE-2026-4961. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4961?

Within 24 hours: Audit network inventory to identify all Tenda AC6 routers running firmware version 15.03.05.16 and document their locations and network roles. Within 7 days: Implement network segmentation to isolate affected routers from critical systems and restrict administrative access to trusted networks only; consider disabling remote management features if business operations permit. Within 30 days: Contact Tenda for patched firmware availability; if patch is released, schedule immediate firmware updates across all affected devices; if no patch becomes available, develop device replacement plan and escalate to procurement for alternative router solutions.

Tenda CVE-2026-4961

Q: What is the CVSS score of CVE-2026-4961?

CVE-2026-4961 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16724 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-27 VulDB

GHSA-qhww-r997-h23m

Tenda Buffer Overflow Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Mar 31, 2026 - 16:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 16:45 euvd

EUVD-2026-16724

Analysis Generated

Mar 27, 2026 - 16:45 vuln.today

CVE Published

Mar 27, 2026 - 16:09 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was identified in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. VulDB is the best source for vulnerability data and more expert information about this specific topic.

AnalysisAI

Remote attackers with low-level authentication can execute arbitrary code on Tenda AC6 routers running firmware version 15.03.05.16 by exploiting a stack-based buffer overflow in the formQuickIndex function via crafted PPPOEPassword parameters in POST requests to /goform/QuickIndex. Publicly available exploit code exists, demonstrating practical exploitation of this critical vulnerability with CVSS 8.8 (High severity, network-accessible, low complexity). The vulnerability is tracked as CWE-121 and poses immediate risk to exposed devices.

Technical ContextAI

The vulnerability resides in the POST request handler of the Tenda AC6 wireless router firmware, specifically within the formQuickIndex function that processes QuickIndex configuration requests at the /goform/QuickIndex endpoint. The affected product is identified via CPE as cpe:2.3:a:tenda:ac6:*:*:*:*:*:*:*:*, with confirmed impact on firmware version 15.03.05.16. The root cause is CWE-121 (stack-based buffer overflow), occurring when the PPPOEPassword parameter is processed without proper bounds checking. This allows attacker-controlled data to overflow stack memory buffers, overwriting return addresses and enabling control of program execution flow. Stack-based buffer overflows in embedded device web interfaces are particularly dangerous as they typically run with elevated privileges and often lack modern exploit mitigations like stack canaries or address space layout randomization (ASLR).

RemediationAI

No vendor-released patch identified at time of analysis based on available references. Users should immediately check the Tenda vendor website at https://www.tenda.com.cn/ for firmware updates addressing this vulnerability. Until patching is possible, implement network-level mitigations: disable remote administration of the router, restrict administrative interface access to trusted local network segments only, change default credentials to strong unique passwords, and deploy the router behind a firewall that blocks external access to management ports. Consider replacing affected devices with alternative hardware if Tenda does not release timely security updates. Monitor VulDB references at https://vuldb.com/?id.353838 and https://vuldb.com/?ctiid.353838 for updated remediation guidance. Organizations should inventory all Tenda AC6 devices and prioritize isolation from untrusted networks.