Tenda AC10 CVE-2026-51380

Exploitation requires network reachability to the router's embedded web management server and the ability to send a request to the /cgi-bin/UploadCfg CGI endpoint on Tenda AC10 v3 running firmware V03.03.16.09. The CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N) are required, so a request to the vulnerable endpoint is the core prerequisite. The primary limiting factor is exposure: router administration interfaces are LAN-bound by default, so remote internet exploitation depends on remote/WAN management being explicitly enabled - otherwise the attacker must already be on the local network. Exploitation is also tied to this specific hardware revision (v3) and firmware build; other versions are unconfirmed. Reliable code execution (versus a simple crash) additionally requires overcoming embedded-target constraints, which is why the description qualifies RCE as only potential.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) portrays an unauthenticated, low-complexity, network-reachable flaw with full impact - a top-priority profile on paper. However, the signals partially conflict: EPSS is only 0.17% (7th percentile) and the issue is not in CISA KEV, indicating no confirmed active or mass exploitation. The RCE outcome is described as only 'potentially' achievable, while the DoS impact is stated more definitively, so the C:H/I:H portion of the score is aspirational rather than proven. Real-world exposure is also constrained by the fact that router management interfaces are typically LAN-bound; internet-wide exploitation depends on remote management being exposed, which is non-default. Net assessment: a genuinely serious flaw for anyone who can reach the device, but the practical priority is elevated (not emergency) absent evidence of WAN exposure or active exploitation. The 'network vector' in CVSS should be read as 'reachable over the network stack,' which in most home deployments means the local network, not the open internet.

An attacker on the same network segment as the router (or with reach to an exposed management interface) sends a crafted HTTP request with an oversized field to /cgi-bin/UploadCfg, overflowing a fixed-size buffer in the router's httpd process. This crashes the device into a permanent, unrecoverable state (DoS) or, with a carefully constructed payload, redirects execution to attacker-supplied shellcode for code execution on the router. Proof-of-concept material published on GitHub lowers the effort required to reproduce the crash.