Ac9
Monthly
Stack-based buffer overflow in the Tenda AC9 wireless router (firmware 15.03.02.13) allows an attacker to corrupt memory and potentially execute code remotely by sending a crafted POST request containing an oversized netWanType parameter to the /goform/fast_setting_internet_set endpoint. Exploitation requires a privileged session on the device's web management interface (CVSS 4.0 PR:H / assessed CVSS 3.1 PR:H), and in default deployments the management UI is LAN-facing, so remote reach generally depends on remote management being enabled or unchanged default credentials. Publicly available exploit code exists, but no CISA KEV entry confirms active exploitation at time of analysis.
Stack-based buffer overflow in Tenda AC9 router firmware 15.03.02.13 enables authenticated remote attackers to execute arbitrary code or crash the device. The vulnerability resides in the decodePwd function within /goform/WizardHandle POST request handler, triggered by manipulating the WANS parameter. Attack requires low-privilege authentication but no user interaction. CVSS 8.8 (High) reflects potential for complete system compromise. Publicly available exploit code exists; no confirmed active exploitation (CISA KEV).
Stack-based buffer overflow in Tenda AC9 router firmware 15.03.02.13 allows authenticated remote attackers to execute arbitrary code via crafted PPPOEPassword parameter to formQuickIndex endpoint. Attack requires low-privilege credentials but no user interaction, enabling complete device compromise. Publicly available exploit code exists. CVSS 8.8 reflects network-accessible attack path with high impact to confidentiality, integrity, and availability.
Authentication bypass in Tenda AC9 firmware 15.03.05.14 allows unauthenticated remote attackers to circumvent the web management interface's R7WebsSecurityHandler authentication gating. Published PoC files demonstrate two concrete attack paths: unauthenticated product information disclosure via the getProduct endpoint and unauthenticated WiFi credential modification via the fast_setting_wifi_set endpoint. No public vendor patch has been identified, and exploit code is publicly available (CVSS 4.0 E:P).
Stack-based buffer overflow in the Tenda AC9 wireless router (firmware 15.03.02.13) allows an attacker to corrupt memory and potentially execute code remotely by sending a crafted POST request containing an oversized netWanType parameter to the /goform/fast_setting_internet_set endpoint. Exploitation requires a privileged session on the device's web management interface (CVSS 4.0 PR:H / assessed CVSS 3.1 PR:H), and in default deployments the management UI is LAN-facing, so remote reach generally depends on remote management being enabled or unchanged default credentials. Publicly available exploit code exists, but no CISA KEV entry confirms active exploitation at time of analysis.
Stack-based buffer overflow in Tenda AC9 router firmware 15.03.02.13 enables authenticated remote attackers to execute arbitrary code or crash the device. The vulnerability resides in the decodePwd function within /goform/WizardHandle POST request handler, triggered by manipulating the WANS parameter. Attack requires low-privilege authentication but no user interaction. CVSS 8.8 (High) reflects potential for complete system compromise. Publicly available exploit code exists; no confirmed active exploitation (CISA KEV).
Stack-based buffer overflow in Tenda AC9 router firmware 15.03.02.13 allows authenticated remote attackers to execute arbitrary code via crafted PPPOEPassword parameter to formQuickIndex endpoint. Attack requires low-privilege credentials but no user interaction, enabling complete device compromise. Publicly available exploit code exists. CVSS 8.8 reflects network-accessible attack path with high impact to confidentiality, integrity, and availability.
Authentication bypass in Tenda AC9 firmware 15.03.05.14 allows unauthenticated remote attackers to circumvent the web management interface's R7WebsSecurityHandler authentication gating. Published PoC files demonstrate two concrete attack paths: unauthenticated product information disclosure via the getProduct endpoint and unauthenticated WiFi credential modification via the fast_setting_wifi_set endpoint. No public vendor patch has been identified, and exploit code is publicly available (CVSS 4.0 E:P).