EUVD-2026-21312
GHSA-wqhq-hx3v-9xwh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Tenda AC9 web interface
-
DeliverySend POST request to /goform/WizardHandle
-
ExploitInject oversized payload in WANS parameter
-
ExecutionOverflow stack buffer in decodePwd function
-
ImpactExecute arbitrary code with device privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access to Tenda AC9 router running firmware 15.03.02.13. Attacker must send a crafted POST request to /goform/WizardHandle with a malicious WANS parameter to trigger stack-based buffer overflow in the decodePwd function. |
| Impact | CVSS 8.8 reflects high severity: authenticated remote attacker exploits stack-based buffer overflow in Tenda AC9 firmware via WANS parameter, achieving complete system compromise (confidentiality, integrity, availability). Publicly available exploit code and moderate observed exploitation activity elevate practical risk despite authenticated requirement; firmware devices often lack patching mechanisms. |
| Exploit ScenarioDerived | Attacker with valid credentials sends POST request to /goform/WizardHandle with oversized WANS parameter, triggering stack overflow in decodePwd function. Overflow overwrites return address, enabling arbitrary code execution with device privileges. Publicly available exploit code exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Stack-based buffer overflow in Tenda AC9 router firmware 15.03.02.13 enables authenticated remote attackers to execute arbitrary code or crash the device. The vulnerability resides in the decodePwd function within /goform/WizardHandle POST request handler, triggered by manipulating the WANS parameter. Attack requires low-privilege authentication but no user interaction. CVSS 8.8 (High) reflects potential for complete system compromise. Publicly available exploit code exists; no confirmed active exploitation (CISA KEV).
RemediationAI
No vendor-released patch identified at time of analysis. Monitor Tenda support portal (https://www.tenda.com.cn/) for firmware updates addressing CVE-2026-6016. Immediate mitigations: restrict administrative access to trusted IP addresses via firewall rules, disable remote management interfaces if not operationally required, enforce strong authentication credentials to limit PR:L attack vector exploitation. Evaluate device replacement if vendor does not issue patch within acceptable timeframe. Network segmentation isolates vulnerable routers from critical infrastructure. Advisory reference: https://vuldb.com/vuln/356572 provides technical details and proof-of-concept context.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-121 stack-based buffer overflow occurs in decodePwd function processing WANS parameter without adequate bounds checking. POST handler at /goform/WizardHandle accepts oversized input, overwriting stack memory. CVSS vector PR:L indicates exploitation requires authenticated access, reducing attack surface but enabling lateral movement post-credential compromise.
Know when Ac9 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in Tenda AC9 15.03.02.13. The affected element is the function decodePwd of the file /goform/WizardHandle of the component POST Request Handler. Performing a manipulation of the argument WANS results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used.
Executive ViewAI
Tenda AC9 routers running firmware 15.03.02.13 contain a critical stack-based buffer overflow in the WizardHandle request handler that allows authenticated attackers to execute arbitrary code and fully compromise the device. This vulnerability directly impacts organizational network infrastructure, potentially enabling lateral movement, data exfiltration, and persistent network access if affected routers are deployed in corporate or branch office environments.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict access to router administrative interfaces via network ACLs and firewall rules to trusted internal IP addresses only; (2) Enforce strong authentication credentials for low-privilege and administrative accounts; (3) Disable remote management access if operationally feasible; (4) Monitor router administrative logs for unauthorized authentication attempts and anomalous requests to /goform/WizardHandle endpoint; (5) Implement network segmentation to isolate affected routers from sensitive systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Related Vulnerabilities in Tenda AC9 Buffer Overflow
View all 2Stack-based buffer overflow in the Tenda AC9 wireless router (firmware 15.03.02.13) allows an attacker to corrupt memory
Authentication bypass in Tenda AC9 firmware 15.03.05.14 allows unauthenticated remote attackers to circumvent the web ma
Exploit-DB