Description

A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. This affects the function set_device_name of the file /goform/SetOnlineDevName of the component httpd web management interface. The manipulation of the argument devName results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T04:16:36.177Z",
  "pubdate": "2026-08-14T04:16:36.177Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified within the httpd web management interface of Tenda AC1206 running firmware version 15.03.06.23_multi_TD01. The flaw exists in the set_device_name function, specifically within the handling of the devName parameter processed by the endpoint /goform/SetOnlineDevName. Remote unauthenticated attackers can exploit this vulnerability to trigger memory corruption, potentially leading to arbitrary code execution and a complete compromise of the affected routing device. The availability of public exploit material significantly increases the risk of active exploitation by malicious actors scanning for vulnerable routers exposed to the network. Remediation requires deploying vendor-supplied patches or restricting network access to the management interface.",
  "technicalDetails": "The vulnerability resides in the httpd binary of the Tenda AC1206 firmware version 15.03.06.23_multi_TD01, specifically within the HTTP request handling routine associated with the /goform/SetOnlineDevName URI. When a client issues an HTTP request to this endpoint, the underlying web server invokes the set_device_name function to process parameters supplied in the request body or query string. The root cause of the vulnerability is the unsafe processing of the devName argument. The binary fails to perform adequate bounds checking or input validation on the length of the string copied into a fixed-size stack buffer. When an attacker supplies an excessively long string via the devName argument, a classic stack-based buffer overflow occurs. This overwrites adjacent memory structures on the stack, including saved frame pointers and the return address. Because the return address is corrupted with attacker-controlled data, the execution flow is hijacked when the vulnerable function attempts to return. Depending on the architecture and mitigations present in the embedded Linux environment, an attacker can construct a malicious payload utilizing return-oriented programming (ROP) chains or direct shellcode execution to achieve remote code execution (RCE) with the privileges of the httpd process, which typically runs as root on such embedded devices. The attack vector is fully remote, as the HTTP management interface is accessible over the network, and the vulnerability can be triggered without prior authentication or privileged access. Post-exploitation impact includes full system compromise, interception of network traffic, reconfiguration of device settings, and pivoting into the local area network."
}