Description

A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. This vulnerability affects the function set_wl_guest_iplist of the file /goform/WifiGuestSet of the component httpd web management interface. This manipulation of the argument shareSpeed causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T04:16:40.620Z",
  "pubdate": "2026-08-14T04:16:40.620Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability has been identified in the Tenda AC1206 router running firmware version 15.03.06.23_multi_TD01. The flaw resides within the httpd web management interface, specifically inside the /goform/WifiGuestSet endpoint and its underlying set_wl_guest_iplist function. This security defect is triggered when an attacker manipulates the shareSpeed argument with excessively long input data that lacks proper bounds checking. Successful exploitation of this vulnerability allows for remote execution of arbitrary code, memory corruption, and potential complete compromise of the affected routing device. The vulnerability presents significant risk implications because the attack vector is exposed remotely over the network without requiring complex preconditions. Threat actors can execute the exploit publicly, leveraging available proof-of-concept material to target vulnerable devices. No authentication or privileged access is explicitly described as a prerequisite in the operational flow, heightening the overall severity and exposure of the affected hardware.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow stemming from unsafe memory handling within the httpd web management interface of the Tenda AC1206 router. The specific flaw is located in the set_wl_guest_iplist function, which processes HTTP POST or GET parameters submitted to the /goform/WifiGuestSet URI. The root cause of the vulnerability is the absence of rigorous length validation and bounds checking on user-supplied input parameters, specifically the shareSpeed argument. When the binary processes the HTTP request, it copies the contents of the shareSpeed parameter into a fixed-size stack buffer. Because the length of the input string is not adequately restricted or compared against the destination buffer's maximum capacity, an attacker can supply a payload that exceeds the allocated memory bounds. This overflows the stack, resulting in the corruption of adjacent stack memory, including saved frame pointers and the return address of the function. When set_wl_guest_iplist completes execution and attempts to return control to its caller, the CPU jumps to the memory address overwritten by the malicious payload, effectively redirecting execution flow. The vulnerable component is exposed via the HTTP protocol on the network management interface of the router, making it reachable remotely. Depending on the memory architecture and protections present in the firmware binary, an attacker can craft a shellcode payload or utilize return-oriented programming (ROP) chains to achieve arbitrary code execution. The post-exploitation impact includes full control over the httpd daemon process, potential escalation to root privileges depending on the daemon's execution context, reconfiguration of the routing device, interception of network traffic, and persistence within the local network infrastructure."
}