Ac10 EUVD-2026-19044

Requires authenticated access to Tenda AC10 firmware version 16.03.10.10_TDE01. Attacker must have login credentials to access the /bin/httpd service and manipulate the sys.userpass parameter in the fromSysToolChangePwd function to trigger stack-based buffer overflow.

Real-world risk assessment indicates this is a genuine priority concern despite requiring authentication. The CVSS vector (AV:N/AC:L/PR:L/UI:N) shows network-accessible exploitation with low attack complexity requiring only low-privilege credentials-often trivially obtained through default credentials (admin/admin) that many users never change on consumer routers. Publicly available exploit code exists per the GitHub reference, significantly lowering the attacker skill barrier. While not in CISA KEV (no confirmed active exploitation), the combination of available POC, simple exploitation requirements, and complete system compromise potential (C:H/I:H/A:H) creates substantial risk for internet-facing deployments. Consumer routers are attractive targets for botnet recruitment and network pivot operations. The SSVC framework would classify this as high technical impact (arbitrary code execution), potentially automatable once weaponized, though exploitation status remains POC-only. The primary risk mitigation factor is the PR:L requirement, but this is weak protection given credential reuse and default password prevalence in IoT devices.

An attacker discovers a Tenda AC10 router exposed to the internet with its web management interface accessible on port 80 or 8080. Using default credentials (admin/admin) or credentials obtained through credential stuffing attacks, the attacker authenticates to the router's administrative panel. They then craft a malicious HTTP request to the password change function, embedding oversized input in the sys.userpass parameter that triggers the stack-based buffer overflow in fromSysToolChangePwd. The carefully constructed payload overwrites the stack return address, redirecting execution to attacker-controlled shellcode that establishes persistent backdoor access with root privileges. With publicly available exploit code from the GitHub repository, even moderately skilled attackers can adapt the POC to weaponize this vulnerability for botnet recruitment or network reconnaissance operations.