Ac10 EUVD-2026-19048

Requires authenticated access to Tenda AC10 16.03.10.10_multi_TDE01. Attacker must be a logged-in user with credentials. Remote exploitation via HTTP to /bin/httpd fromSysToolChangePwd endpoint. No victim interaction needed beyond initial authentication.

Real-world risk is HIGH for deployed Tenda AC10 routers with this firmware version despite requiring authentication. The CVSS 8.8 score accurately reflects severe impact (C:H/I:H/A:H) with network-based attack vector (AV:N) and low complexity (AC:L). While authentication is required (PR:L), consumer router credentials are frequently weak, default, or exposed through prior compromise. The vulnerability enables full device takeover including firmware manipulation, traffic interception, and pivot point establishment for lateral network movement. EPSS data not provided, but similar router vulnerabilities typically show moderate-to-high exploitation probability due to automated scanning and botnet recruitment value. No CISA KEV listing indicates no confirmed active exploitation campaigns at time of analysis, though the publication of detailed technical findings on GitHub significantly lowers the barrier for exploit development. SSVC factors suggest elevated priority: exploitation is technically feasible (low complexity, public research available), impact is critical (full system compromise of network perimeter device), and automation potential is moderate once exploit code emerges. The attack requires crossing only a single trust boundary (web authentication), making this a realistic threat against internet-exposed management interfaces or compromised LAN environments.

An attacker on the internet or local network first performs credential stuffing attacks against the router's web management interface using common default passwords (admin/admin) or credentials harvested from previous breaches. After successful authentication with low-privilege user credentials, the attacker crafts a malicious HTTP POST request to the system tools password change endpoint, embedding an oversized payload that triggers the stack-based buffer overflow in the fromSysToolChangePwd function. By carefully controlling the overflow data, the attacker overwrites the stack return address to redirect execution to injected shellcode, gaining root-level code execution on the router. With full device control, the attacker installs persistent backdoor firmware, configures DNS hijacking to redirect users to phishing sites, harvests network traffic including credentials and sensitive data, or enlists the compromised router into a botnet for DDoS attacks. The low attack complexity and network accessibility make this vulnerability attractive for automated exploitation tools once proof-of-concept code becomes available.