What is the CVSS score of CVE-2026-67822?

CVE-2026-67822 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Tenda W6-S are affected by CVE-2026-67822?

Tenda W6-S routers running firmware 1.0.0.4(510) contain a critical remote vulnerability that enables attackers to disable network infrastructure or gain unrestricted administrative access; any…

How to fix or mitigate CVE-2026-67822?

Within 24 hours, identify all Tenda W6-S routers running firmware 1.0.0.4(510) in your environment and document their network locations and criticality. Within 7 days, implement compensating controls: block external access to the /goform/wifiSSIDset endpoint via firewall rules, disable remote management and web access where operationally feasible, and move affected routers to an isolated network segment away from sensitive systems. Within 30 days, check Tenda's official advisories for patched firmware versions, test any update in a lab environment, and perform a staged rollout of patches across all affected devices; if no patch emerges, evaluate device replacement options.

Tenda W6-S CVE-2026-67822

EUVD-2026-51587 CRITICAL

Stack-based Buffer Overflow (CWE-121)

2026-07-31 mitre

GHSA-3xxh-hm67-x74r

Buffer Overflow Tenda Stack Overflow N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Router web-management endpoint is normally reachable only from the LAN/Wi-Fi side, so AV:A rather than AV:N; no auth or bounds check gives PR:N/AC:L, and memory-corruption RCE yields full C/I/A:H.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:39 vuln.today

CVE Published

Jul 31, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 31, 2026 - 00:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length restriction, leading to stack overflow.

AnalysisAI

Stack-based buffer overflow in the Tenda W6-S wireless router (firmware 1.0.0.4(510)) lets remote attackers corrupt stack memory by sending oversized 'GO' and 'index' parameters to the /goform/wifiSSIDset endpoint, where the formwrlSSIDset handler copies them into a fixed 64-byte buffer via unbounded sprintf. Successful exploitation can crash the device or achieve arbitrary code execution with full impact to confidentiality, integrity, and availability. Publicly available exploit code exists in the form of a detailed technical write-up, though there is no public exploit identified as weaponized and no confirmed active exploitation.

Technical ContextAI

The affected component is the embedded HTTP management server (typically an httpd/goform CGI-style handler) on the Tenda W6-S SOHO Wi-Fi router. The root cause is CWE-121 (stack-based buffer overflow): the formwrlSSIDset function uses sprintf() to format user-supplied 'GO' and 'index' request parameters into a 64-byte stack-allocated buffer with no length validation or bounds checking. Because sprintf performs no truncation, attacker-controlled input longer than the buffer overwrites adjacent stack memory, including saved registers and the return address on these MIPS/ARM-based embedded devices. This is characteristic of the many /goform/* endpoints in Tenda firmware that pass raw request parameters directly into fixed-size stack buffers.

RemediationAI

No vendor-released patch identified at time of analysis; Tenda has not published a fixed firmware version for this issue in the available data. Because no patched build is confirmed, apply compensating controls: restrict access to the router's web management interface to trusted administrative hosts only and ensure it is never exposed to the WAN/internet (disable any remote-management option), which prevents external reach to /goform/wifiSSIDset at the cost of losing off-LAN administration; segment the router's management VLAN/SSID away from untrusted or guest wireless clients to limit who can reach the endpoint; and monitor for and consider replacing the device if it is end-of-life, since consumer Tenda models often receive no timely fixes. Track the researcher advisory (https://github.com/Tristerjh/Tenda/blob/main/Tenda_W6-S_GO_overflow.md) and the NVD page (https://nvd.nist.gov/vuln/detail/CVE-2026-67822) for a vendor firmware update and apply it immediately once released.