Which versions of Tenda are affected by CVE-2026-5567?

Tenda M3 router firmware 1.0.0.10 contains a buffer overflow vulnerability in the setAdvPolicyData endpoint that allows authenticated attackers to execute arbitrary code on affected devices.

Is there a public PoC exploit available for CVE-2026-5567?

Yes, a public proof-of-concept exploit is available for CVE-2026-5567. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5567?

Within 24 hours: Identify all Tenda M3 routers running firmware 1.0.0.10 across the network using asset inventory tools. Within 7 days: Restrict network access to the affected routers' management interfaces to authorized administrative personnel only; implement network segmentation to isolate routers from critical assets. Within 30 days: Contact Tenda for firmware update availability; if no patch is released, evaluate replacement with alternative router models from vendors with active security support.

Tenda CVE-2026-5567

Q: What is the CVSS score of CVE-2026-5567?

CVE-2026-5567 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19081 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-05 VulDB

Tenda Buffer Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 13:15 euvd

EUVD-2026-19081

Analysis Generated

Apr 05, 2026 - 13:15 vuln.today

CVE Published

Apr 05, 2026 - 12:45 nvd

HIGH 7.4

DescriptionCVE.org

A flaw has been found in Tenda M3 1.0.0.10. This vulnerability affects the function setAdvPolicyData of the file /goform/setAdvPolicyData of the component Destination Handler. Executing a manipulation of the argument policyType can lead to buffer overflow. The attack can be executed remotely. The exploit has been published and may be used.

AnalysisAI

Buffer overflow in Tenda M3 router firmware 1.0.0.10 allows authenticated remote attackers to achieve code execution via the setAdvPolicyData endpoint. The vulnerability resides in the Destination Handler component's policyType parameter processing. Publicly available exploit code exists (GitHub POC), elevating immediate risk despite low-privilege authentication requirement. CVSS 7.4 reflects network-accessible attack with low complexity; no CISA KEV listing indicates exploitation remains proof-of-concept stage rather than widespread campaign targeting.

Technical ContextAI

This vulnerability affects the Tenda M3 wireless router (CPE: cpe:2.3:a:tenda:m3:*:*:*:*:*:*:*:*) running firmware version 1.0.0.10. The flaw is a classic stack-based or heap-based buffer overflow (CWE-120) in the setAdvPolicyData function within the /goform/setAdvPolicyData endpoint of the router's web management interface. The Destination Handler component fails to properly validate or sanitize input length for the policyType argument before copying it to a fixed-size buffer. This weakness is common in legacy embedded device firmware where memory-safe practices are not consistently applied. The CVSS vector indicates network attack vector (AV:N) with low complexity (AC:L), meaning the vulnerability can be triggered through standard HTTP requests without cryptographic timing or race conditions. The PR:L (low privileges required) designation indicates an attacker must authenticate to the web interface, typically as a regular user rather than administrator, before submitting malicious input.

RemediationAI

No vendor-released patch identified at time of analysis. The official Tenda website (https://www.tenda.com.cn/) should be monitored for firmware updates addressing CVE-2026-5567. As an immediate mitigation, restrict administrative interface access to trusted internal networks only by disabling remote management features and binding the web interface to LAN-only addresses. Implement strong, unique passwords for router authentication to raise the barrier against credential-based attacks that would enable exploitation. Network segmentation should isolate IoT devices including the Tenda M3 from critical infrastructure. Consider replacing affected devices with alternative router models if Tenda does not release timely security updates, as the vendor's historical patch cadence for consumer devices varies. Monitor VulDB advisories (https://vuldb.com/vuln/355337) and the researcher's GitHub repository (https://github.com/Moxxkidd/CVE/issues/2) for updates on vendor response or additional technical details that may inform workaround strategies.