Which versions of Tenda are affected by EUVD-2026-16981?

A stack-based buffer overflow in Tenda 4G06 router firmware (version 04.06.01.29) enables authenticated attackers to execute arbitrary code remotely, compromising the confidentiality, integrity, and…

Is there a public PoC exploit available for EUVD-2026-16981?

Yes, a public proof-of-concept exploit is available for EUVD-2026-16981. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-16981?

Within 24 hours: Inventory all Tenda 4G06 devices and document firmware version 04.06.01.29 deployment locations. Within 7 days: Contact Tenda for patched firmware availability and conduct risk assessment of affected routers; isolate or restrict remote administrative access via /goform/DhcpListClient endpoint using firewall rules. Within 30 days: Apply vendor-released patch immediately upon availability, or replace affected devices if no patch timeline is provided; verify no unauthorized administrative access in authentication logs.

Tenda EUVD-2026-16981

Q: What is the CVSS score of EUVD-2026-16981?

EUVD-2026-16981 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5036 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-29 VulDB

GHSA-737m-qjmx-7gx3

Tenda Buffer Overflow Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Mar 30, 2026 - 18:58 vuln.today

Public exploit code

EUVD ID Assigned

Mar 29, 2026 - 08:00 euvd

EUVD-2026-16981

Analysis Generated

Mar 29, 2026 - 08:00 vuln.today

CVE Published

Mar 29, 2026 - 07:45 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was found in Tenda 4G06 04.06.01.29. This vulnerability affects the function fromDhcpListClient of the file /goform/DhcpListClient of the component Endpoint. Performing a manipulation of the argument page results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used.

AnalysisAI

Stack-based buffer overflow in Tenda 4G06 router firmware version 04.06.01.29 allows authenticated remote attackers to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The vulnerability resides in the fromDhcpListClient function accessible via the /goform/DhcpListClient endpoint, triggered by manipulating the 'page' parameter. Publicly available exploit code exists (GitHub PoC published), significantly lowering the barrier to exploitation. CVSS 8.8 (High) reflects network-based attack vector with low complexity, though low-privilege authentication is required. Not currently listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis.

Technical ContextAI

This vulnerability affects the web management interface of the Tenda 4G06 wireless router, specifically within the DHCP client list functionality. The fromDhcpListClient function in the /goform/DhcpListClient endpoint fails to properly validate the length of the 'page' parameter before copying it to a fixed-size stack buffer. This is a classic CWE-121 (Stack-based Buffer Overflow) condition where attacker-controlled input exceeds allocated buffer space on the program stack. Embedded router firmware often uses custom web servers with minimal input validation, and stack-based overflows can allow attackers to overwrite return addresses or function pointers to redirect execution flow. The affected product is identified by CPE cpe:2.3:a:tenda:4g06:*:*:*:*:*:*:*:*, with confirmed vulnerable firmware version 04.06.01.29. The /goform/ path pattern is characteristic of Tenda's web interface implementation across multiple router models.

RemediationAI

No vendor-released patch identified at time of analysis despite public disclosure and PoC availability. Organizations should immediately implement the following mitigations: First, verify if devices are running vulnerable firmware version 04.06.01.29 through the web interface or device labels. Disable remote web management access and restrict administrative interface access to trusted internal networks only, blocking WAN-side access at the firewall level. Change all default credentials to strong, unique passwords with minimum 16-character complexity. Monitor Tenda's official support site (https://www.tenda.com.cn/) for firmware updates addressing CVE-2026-5036. As an alternative, consider replacing affected devices with models from vendors demonstrating stronger security update practices if Tenda does not release timely patches. Network segmentation should isolate IoT/router management VLANs from critical systems. The VulDB advisory at https://vuldb.com/vuln/353962 and the researcher's GitHub repository at https://github.com/Kiciot/cve/issues/1 should be monitored for additional technical details or vendor response updates.