EUVD-2026-19044
GHSA-mf8f-5hfr-3cfm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in Tenda AC10 16.03.10.10_multi_TDE01. Affected by this vulnerability is the function fromSysToolChangePwd of the file /bin/httpd. Performing a manipulation of the argument sys.userpass results in stack-based buffer overflow. The attack can be initiated remotely.
AnalysisAI
Stack-based buffer overflow in Tenda AC10 router firmware 16.03.10.10_multi_TDE01 allows authenticated remote attackers to achieve code execution with high impact to confidentiality, integrity, and availability. The vulnerability resides in the fromSysToolChangePwd function within /bin/httpd, triggered by manipulating the sys.userpass parameter. Publicly available exploit code exists (GitHub repository documented), though no confirmed active exploitation (not in CISA KEV). CVSS 8.8 reflects network-accessible attack requiring only low-privilege authentication with low complexity, making this a realistic threat for internet-exposed routers with default or compromised credentials.
Technical ContextAI
This vulnerability affects the Tenda AC10 wireless router (CPE: cpe:2.3:a:tenda:ac10), specifically firmware version 16.03.10.10_multi_TDE01. The flaw is a stack-based buffer overflow (CWE-121) in the fromSysToolChangePwd function within the httpd binary, which handles administrative password change operations. When processing the sys.userpass argument, insufficient input validation allows an attacker to write beyond allocated stack buffer boundaries. Stack-based overflows are particularly dangerous in embedded devices like routers because they can overwrite return addresses and function pointers, enabling arbitrary code execution with the privileges of the web server process, typically running as root on consumer routers. The httpd daemon serves the router's web management interface, making this a web-accessible attack surface.
RemediationAI
No vendor-released patch identified at time of analysis for firmware version 16.03.10.10_multi_TDE01. Users should immediately check the official Tenda support website (https://www.tenda.com.cn/) for any updated firmware releases for the AC10 model that may address this vulnerability. As interim risk mitigation, disable remote administration access to the router's web interface, restricting management access to the local network only. Change all default administrative credentials to strong, unique passwords to raise the authentication barrier. Consider network segmentation to isolate the vulnerable router from critical assets. If vendor support is unavailable, replacement with actively maintained hardware from vendors with established security update programs should be evaluated. Monitor VulDB tracking at https://vuldb.com/vuln/355312 for any vendor response or community-developed patches.
Authentication bypass in Tenda AC10 firmware 16.03.10.09_multi_TDE01 allows unauthenticated remote attackers to circumve
Stack-based buffer overflow in the Tenda AC10 router (firmware 16.03.10.09_multi_TDE01) allows a remote, authenticated a
Tenda AC10 router firmware 16.03.10.10_multi_TDE01 exposes a hard-coded RSA 2048-bit private key in the world-readable f
Stack-based buffer overflow in Tenda AC10 router firmware version 16.03.10.10_multi_TDE01 allows authenticated remote at
OS command injection in Tenda AC10 firmware 16.03.10.10_multi_TDE01 allows authenticated remote attackers to execute arb
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today