Description

A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd web management interface. This manipulation of the argument rebootTime causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T11:16:57.573Z",
  "pubdate": "2026-08-14T11:16:57.573Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability has been identified within the httpd web management interface of Tenda AC12 version 15.03.06.23_multi_TD01. The flaw specifically resides in the function formSetRebootTimer when processing the rebootTime argument via the endpoint /goform/SetSysAutoRebbotCfg.\nThis vulnerability allows remote attackers to trigger a memory corruption condition by supplying a maliciously crafted input that exceeds the allocated buffer size. Successful exploitation of this flaw can lead to denial of service conditions or potentially arbitrary code execution within the context of the running web server daemon.\nGiven that the attack vector is exposed over the network, remote threat actors can initiate exploitation without prior physical access. Public disclosure of exploit materials significantly elevates the risk profile, making unpatched systems prime targets for automated attacks and potential compromise.\nOrganizations utilizing the affected Tenda AC12 firmware version face substantial risk regarding device integrity and availability. Immediate remediation is strongly advised, although specific official patch availability must be verified through the vendor's official advisory channels.",
  "technicalDetails": "The vulnerability is classified as a buffer overflow, specifically occurring within the function formSetRebootTimer located in the httpd web management interface component of the Tenda AC12 firmware. The affected binary processes HTTP requests directed to the URI path /goform/SetSysAutoRebbotCfg.\nThe root cause of the vulnerability stems from inadequate input validation and bounds checking on the rebootTime parameter supplied by the user within the incoming HTTP request. When the formSetRebootTimer function parses the rebootTime argument, it copies the supplied string data into a fixed-size internal buffer without properly verifying the length of the input data.\nBecause the input length is not constrained to the physical boundaries of the destination buffer, an attacker can transmit an excessively long string payload. This payload overflows the stack space allocated for the buffer, overwriting adjacent memory regions, which may include saved frame pointers and return addresses.\nThe attack flow proceeds as follows: First, a remote attacker crafts an HTTP request targeting /goform/SetSysAutoRebbotCfg. Second, the attacker populates the vulnerable rebootTime parameter with a payload designed to exceed the capacity of the target buffer in formSetRebootTimer. Third, the httpd service parses the parameter and performs an unsafe memory copy operation, such as strcpy or sprintf, triggering the stack overflow. Fourth, the instruction pointer is hijacked if the return address is successfully overwritten with malicious shellcode or redirected to existing code constructs.\nThe affected product is Tenda AC12 running firmware version 15.03.06.23_multi_TD01. The vulnerability requires network access to the HTTP management service of the device. Depending on the device's configuration and network exposure, authentication requirements may be bypassed or absent, permitting unauthenticated remote exploitation. Post-exploitation impact includes application crashes leading to denial of service, or complete takeover of the affected router depending on memory protections such as ASLR or NX stack implementation."
}