EUVD-2026-35076
GHSA-qvqm-ccp5-gr98
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach AC1206 admin HTTP port
-
DeliveryCraft POST to fromGstDhcpSetSer
-
ExploitSend oversized username/password parameters
-
ExecutionOverflow stack buffer in handler
-
PersistCrash httpd/router process
-
ImpactDenial of service until reboot
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the AC1206 web management HTTP interface (default LAN port 80) and the ability to submit a POST to the fromGstDhcpSetSer DHCP server configuration handler with attacker-controlled username and password parameters; no credentials or user interaction are needed per CVSS PR:N/UI:N. Limiting factors: the device must be running firmware v15.03.06.23 specifically, the admin web service must be reachable from the attacker (by default Tenda restricts this to LAN, so internet exploitation only works where remote/WAN management has been explicitly enabled or the device is otherwise exposed), and impact is bounded to availability - no data disclosure or persistent compromise is described. |
| Impact | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects a remote, unauthenticated, low-complexity DoS with no confidentiality or integrity impact, which lines up with the description's stack-overflow-causing-crash behavior. EPSS and CISA KEV data are not provided for this CVE, so there is no evidence of mass exploitation; the threat profile is consistent with the broader Tenda research pattern of academic/PoC stack overflows in CGI handlers. Real-world risk is moderate and largely confined to devices whose web admin interface is reachable from untrusted networks (LAN guests or, worse, WAN-exposed management); for properly segmented home/SMB deployments the impact is limited to availability loss until reboot. Note that although a stack overflow technically could enable code execution, the CVSS impact metrics and reporter framing describe this as a DoS only - RCE viability is not confirmed in the source data. |
| Exploit ScenarioDerived | An attacker on the same LAN (for example a guest Wi-Fi client) or, in misconfigured deployments, an internet-based attacker reaching the router's exposed web admin port sends a crafted HTTP POST to the fromGstDhcpSetSer endpoint with oversized username and/or password fields. The httpd worker handling DHCP server configuration overflows its stack buffer and crashes, taking down the router's management plane and typically its routing/DHCP services until a reboot. Researcher PoC artifacts are published in the SemVulLLM GitHub repository, lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Denial of service in Tenda AC1206 routers (firmware v15.03.06.23) is triggered by stack-based buffer overflows in the fromGstDhcpSetSer function reachable through the username and password parameters of a crafted HTTP request. Remote attackers with network reach to the device's web management interface can crash the service without authentication, and no public exploit identified at time of analysis although proof-of-concept research material is hosted on GitHub.
RemediationAI
No vendor-released patch identified at time of analysis; Tenda has not published a fixed firmware version in the supplied references, so administrators should monitor https://www.tendacn.com/ for an AC1206 firmware update superseding v15.03.06.23 and apply it as soon as one is released. As compensating controls, ensure remote (WAN-side) web administration is disabled in the router settings - this eliminates internet-borne exploitation but does not stop a malicious LAN client; restrict LAN-side access to the management interface via a dedicated management VLAN or by blocking the router's admin IP from untrusted SSIDs and guest networks, accepting the trade-off that legitimate admins must connect from the management segment; and, where feasible, replace end-of-life AC1206 hardware with a currently supported model since Tenda consumer devices historically receive limited security maintenance. Reference VulDB entry https://vuldb.com/vuln/369189 and NVD https://nvd.nist.gov/vuln/detail/CVE-2026-36789 for tracking any future fix publication.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The AC1206 is a SOHO wireless router whose web-administration daemon exposes DHCP server configuration through the fromGstDhcpSetSer handler. The flaw is classified as CWE-121 (Stack-based Buffer Overflow), meaning the handler copies attacker-supplied username and password parameters into fixed-size stack buffers without bounds enforcement, corrupting the saved return address or adjacent stack frames. Tenda's consumer firmware is built on a stripped-down Linux/BusyBox stack with limited mitigations (often missing stack canaries and ASLR on the httpd binary), which is why memory-corruption issues in these CGI-style handlers typically produce reliable crashes. The CPE entry is generic (cpe:2.3:a:n/a:n/a) and does not encode the exact device or version, so identification depends on the description itself.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Shenzhen Tenda Technology Co., Ltd Tenda AC1206 v15.03.06.23 was discovered to contain multiple stack overflows in the fromGstDhcpSetSer function via the username and password parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Executive ViewAI
Tenda AC1206 routers (firmware v15.03.06.23) are vulnerable to unauthenticated denial of service attacks via the web management interface that can crash the device remotely. Publicly available exploit code exists, and no vendor patch is available, creating an immediate operational risk for any organization relying on these devices for network connectivity.
Restrict network access to the router's web management interface via firewall rules and network segmentation to authorized administrative networks only. Deploy network-based monitoring to detect traffic patterns targeting the management interface. Maintain documented procedures and monitoring systems to rapidly restore service in the event of a denial of service incident.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB