Tenda EUVD-2026-14349

Remote unauthenticated attacker can exploit stack-based buffer overflow in Tenda A15 firmware version 15.13.07.13 by sending crafted input to the UploadCfg function via /cgi-bin/UploadCfg endpoint. No authentication, special configuration, or user interaction required.

This vulnerability presents critical real-world risk based on multiple converging signals. The CVSS score of 9.8 reflects maximum severity with network-based attack vector (AV:N), low complexity (AC:L), and no authentication required (PR:N), meaning any remote attacker can exploit this without credentials. The availability of a public proof-of-concept exploit (referenced in GitHub as a detailed ZIP archive) dramatically lowers the skill barrier for exploitation and increases the likelihood of mass scanning campaigns targeting vulnerable devices. While EPSS data is not provided, the combination of unauthenticated remote access, public exploit code, and buffer overflow leading to code execution makes this a genuine priority requiring immediate attention. The vulnerability is automatable and has critical technical impact (full system compromise), placing it in the highest risk category under SSVC decision frameworks. Unlike some high-CVSS vulnerabilities with limited exposure, this affects consumer routers that are Internet-facing by nature and rarely patched.

An attacker scans the Internet for Tenda A15 routers exposing the web management interface on port 80/443, identifies vulnerable firmware versions through banner grabbing or fingerprinting, and sends a specially crafted HTTP request to /cgi-bin/UploadCfg with an oversized File parameter payload containing shellcode. The stack buffer overflow overwrites the return address, redirecting execution to attacker-controlled code that establishes persistent backdoor access, modifies DNS settings to redirect victim traffic, or enlists the router in a botnet. Since a public proof-of-concept exploit is available (https://github.com/user-attachments/files/25824036/Tenda.A15.V15.13.07.13.Unauthenticated.Stack-based.Buffer.Overflow.in._cgi-bin_UploadCfg.zip), even low-skilled attackers can weaponize this vulnerability for mass exploitation campaigns without requiring authentication.