Ac20 Firmware
Monthly
Stack-based buffer overflow in the Tenda AC20 router (firmware 16.03.08.12) allows an authenticated attacker who can reach the device's management web interface to corrupt memory and potentially execute code or crash the httpd service by sending an oversized schedStartTime or schedEndTime value to the /goform/openSchedWifi endpoint. The issue carries a CVSS 4.0 score of 7.4 (E:P) and our independent assessment scores it CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity and availability impact once a low-privilege session is established. Publicly available exploit code exists, though EPSS is low at 0.74% (53rd percentile) and there is no confirmed active exploitation (not listed in CISA KEV).
Stack-based buffer overflow in the Tenda AC20 router running firmware 16.03.08.12 allows a remote attacker to overwrite stack memory by sending a crafted rebootTime value to the formSetRebootTimer handler behind /goform/SetSysAutoRebbotCfg, leading to a daemon crash and potential arbitrary code execution in the httpd process. Publicly available exploit code exists, so any unit whose web management interface is reachable from an untrusted network should be treated as at risk. The flaw carries a CVSS 4.0 base score of 7.4 with exploit maturity E:P; the supplied vector indicates low-privilege authentication (PR:L) and no user interaction, but authentication requirements are not confirmed by the description, and this bug class is frequently pre-authentication on Tenda devices, so the true prerequisite should be verified against the firmware.
A stack-based buffer overflow in the httpd component of Tenda AC20 firmware 16.03.08.12 allows a remote attacker to overwrite memory on the stack by submitting an oversized 'list' argument to the /goform/setPptpUserList endpoint, which is processed by the formSetPPTPUserList function. Based on the CVSS vector the attacker must first authenticate with at least low-privilege credentials (PR:L) and be able to reach the device's web-management interface, which is normally confined to the LAN unless remote management is enabled or the router is directly exposed. Publicly available exploit code exists (a public write-up with proof-of-concept is linked from the NVD references), and EPSS assigns a 3.33% exploitation likelihood (88th percentile), but there is no confirmed active exploitation (CISA KEV) and no vendor-released patch identified at the time of analysis.
A vulnerability was detected in Tenda AC20 up to 16.03.08.12. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Buffer overflow in the Tenda AC20 router firmware (up to and including 16.03.08.12) lets remote attackers corrupt memory via the timeZone parameter of the /goform/fast_setting_wifi_set web endpoint, with high confidentiality, integrity, and availability impact. Per the CVSS 4.0 vector the attack requires low-privilege authentication (PR:L) and no user interaction, although the same class of Tenda /goform setup handlers has historically been reachable without credentials, so the auth requirement is worth verifying. Publicly available exploit code exists for this flaw, but there is no confirmation of active exploitation; the main practical barrier is that the web management interface is normally LAN-only, so internet-facing exploitation depends on the device being exposed to a network segment an attacker controls.
A vulnerability was identified in Tenda AC20 up to 16.03.08.12. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was detected in Tenda AC20 up to 16.03.08.12. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Tenda AC20 16.03.08.05. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Tenda AC20 16.03.08.12. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Tenda AC20 16.03.08.12. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Tenda AC20 16.03.08.12. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Tenda AC20 16.03.08.12. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Tenda AC20 up to 16.03.08.12. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Tenda AC20 up to 16.03.08.12. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in Tenda AC20 16.03.08.05. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stack-based buffer overflow in the Tenda AC20 router (firmware 16.03.08.12) allows an authenticated attacker who can reach the device's management web interface to corrupt memory and potentially execute code or crash the httpd service by sending an oversized schedStartTime or schedEndTime value to the /goform/openSchedWifi endpoint. The issue carries a CVSS 4.0 score of 7.4 (E:P) and our independent assessment scores it CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity and availability impact once a low-privilege session is established. Publicly available exploit code exists, though EPSS is low at 0.74% (53rd percentile) and there is no confirmed active exploitation (not listed in CISA KEV).
Stack-based buffer overflow in the Tenda AC20 router running firmware 16.03.08.12 allows a remote attacker to overwrite stack memory by sending a crafted rebootTime value to the formSetRebootTimer handler behind /goform/SetSysAutoRebbotCfg, leading to a daemon crash and potential arbitrary code execution in the httpd process. Publicly available exploit code exists, so any unit whose web management interface is reachable from an untrusted network should be treated as at risk. The flaw carries a CVSS 4.0 base score of 7.4 with exploit maturity E:P; the supplied vector indicates low-privilege authentication (PR:L) and no user interaction, but authentication requirements are not confirmed by the description, and this bug class is frequently pre-authentication on Tenda devices, so the true prerequisite should be verified against the firmware.
A stack-based buffer overflow in the httpd component of Tenda AC20 firmware 16.03.08.12 allows a remote attacker to overwrite memory on the stack by submitting an oversized 'list' argument to the /goform/setPptpUserList endpoint, which is processed by the formSetPPTPUserList function. Based on the CVSS vector the attacker must first authenticate with at least low-privilege credentials (PR:L) and be able to reach the device's web-management interface, which is normally confined to the LAN unless remote management is enabled or the router is directly exposed. Publicly available exploit code exists (a public write-up with proof-of-concept is linked from the NVD references), and EPSS assigns a 3.33% exploitation likelihood (88th percentile), but there is no confirmed active exploitation (CISA KEV) and no vendor-released patch identified at the time of analysis.
A vulnerability was detected in Tenda AC20 up to 16.03.08.12. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Buffer overflow in the Tenda AC20 router firmware (up to and including 16.03.08.12) lets remote attackers corrupt memory via the timeZone parameter of the /goform/fast_setting_wifi_set web endpoint, with high confidentiality, integrity, and availability impact. Per the CVSS 4.0 vector the attack requires low-privilege authentication (PR:L) and no user interaction, although the same class of Tenda /goform setup handlers has historically been reachable without credentials, so the auth requirement is worth verifying. Publicly available exploit code exists for this flaw, but there is no confirmation of active exploitation; the main practical barrier is that the web management interface is normally LAN-only, so internet-facing exploitation depends on the device being exposed to a network segment an attacker controls.
A vulnerability was identified in Tenda AC20 up to 16.03.08.12. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was detected in Tenda AC20 up to 16.03.08.12. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Tenda AC20 16.03.08.05. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Tenda AC20 16.03.08.12. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Tenda AC20 16.03.08.12. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Tenda AC20 16.03.08.12. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Tenda AC20 16.03.08.12. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Tenda AC20 up to 16.03.08.12. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Tenda AC20 up to 16.03.08.12. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in Tenda AC20 16.03.08.05. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.