Which versions of Tenda are affected by CVE-2026-5548?

Tenda AC10 routers running firmware 16.03.10.10_multi_TDE01 contain a stack-based buffer overflow vulnerability (CVSS 8.8) that allows authenticated attackers to achieve complete system compromise.

How to fix or mitigate CVE-2026-5548?

Within 24 hours: Identify all Tenda AC10 routers in your environment and verify current firmware version via device management console. Within 7 days: Restrict network access to affected routers-disable remote management, implement network segmentation, and change default credentials on all devices. Within 30 days: Contact Tenda for firmware availability; if no patch is released, evaluate replacement with alternative router firmware or products with active security support.

Tenda CVE-2026-5548

Q: What is the CVSS score of CVE-2026-5548?

CVE-2026-5548 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19044 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-05 VulDB

GHSA-mf8f-5hfr-3cfm

Tenda Buffer Overflow Stack Overflow

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 05, 2026 - 08:00 euvd

EUVD-2026-19044

Analysis Generated

Apr 05, 2026 - 08:00 vuln.today

CVE Published

Apr 05, 2026 - 07:30 nvd

HIGH 8.7

DescriptionCVE.org

A vulnerability was found in Tenda AC10 16.03.10.10_multi_TDE01. Affected by this vulnerability is the function fromSysToolChangePwd of the file /bin/httpd. Performing a manipulation of the argument sys.userpass results in stack-based buffer overflow. The attack can be initiated remotely.

AnalysisAI

Stack-based buffer overflow in Tenda AC10 router firmware 16.03.10.10_multi_TDE01 allows authenticated remote attackers to achieve code execution with high impact to confidentiality, integrity, and availability. The vulnerability resides in the fromSysToolChangePwd function within /bin/httpd, triggered by manipulating the sys.userpass parameter. Publicly available exploit code exists (GitHub repository documented), though no confirmed active exploitation (not in CISA KEV). CVSS 8.8 reflects network-accessible attack requiring only low-privilege authentication with low complexity, making this a realistic threat for internet-exposed routers with default or compromised credentials.

Technical ContextAI

This vulnerability affects the Tenda AC10 wireless router (CPE: cpe:2.3:a:tenda:ac10), specifically firmware version 16.03.10.10_multi_TDE01. The flaw is a stack-based buffer overflow (CWE-121) in the fromSysToolChangePwd function within the httpd binary, which handles administrative password change operations. When processing the sys.userpass argument, insufficient input validation allows an attacker to write beyond allocated stack buffer boundaries. Stack-based overflows are particularly dangerous in embedded devices like routers because they can overwrite return addresses and function pointers, enabling arbitrary code execution with the privileges of the web server process, typically running as root on consumer routers. The httpd daemon serves the router's web management interface, making this a web-accessible attack surface.

RemediationAI

No vendor-released patch identified at time of analysis for firmware version 16.03.10.10_multi_TDE01. Users should immediately check the official Tenda support website (https://www.tenda.com.cn/) for any updated firmware releases for the AC10 model that may address this vulnerability. As interim risk mitigation, disable remote administration access to the router's web interface, restricting management access to the local network only. Change all default administrative credentials to strong, unique passwords to raise the authentication barrier. Consider network segmentation to isolate the vulnerable router from critical assets. If vendor support is unavailable, replacement with actively maintained hardware from vendors with established security update programs should be evaluated. Monitor VulDB tracking at https://vuldb.com/vuln/355312 for any vendor response or community-developed patches.