CVE-2026-2876
Stack-Based Buffer Overflow in Tenda A18 parse_macfilter_rule
Publication date: 2026-02-21
Last updated on: 2026-02-23
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | a18_firmware | 15.13.07.13 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-2876 is a critical stack-based buffer overflow vulnerability found in the Tenda A18 router, version 15.13.07.13.
The flaw exists in the function parse_macfilter_rule within the /goform/setBlackRule endpoint, specifically due to improper handling of the deviceList argument.
Manipulating the deviceList parameter with crafted input causes a stack-based buffer overflow, which can be exploited remotely without local access or physical interaction.
This vulnerability can lead to denial of service or potentially arbitrary code execution on the device.
How can this vulnerability impact me? :
Exploitation of this vulnerability can compromise the confidentiality, integrity, and availability of the affected Tenda A18 router.
An attacker can remotely trigger a denial of service (DoS) or execute arbitrary code, potentially taking control of the device.
This could disrupt network operations, lead to unauthorized access, or cause device malfunction.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability involves a stack-based buffer overflow triggered by manipulation of the 'deviceList' parameter in the '/goform/setBlackRule' endpoint of the Tenda A18 router firmware version 15.13.07.13."}, {'type': 'paragraph', 'content': "Detection on your network or system would involve monitoring for suspicious or malformed HTTP requests targeting the '/goform/setBlackRule' endpoint, especially those containing unusually long or crafted 'deviceList' parameters."}, {'type': 'paragraph', 'content': 'Since the vulnerability is exploited remotely via HTTP requests, you can use network traffic inspection tools or intrusion detection systems (IDS) to look for such patterns.'}, {'type': 'list_item', 'content': "Use tools like tcpdump or Wireshark to capture HTTP traffic to the router and filter for requests to '/goform/setBlackRule'."}, {'type': 'list_item', 'content': 'Example tcpdump command: tcpdump -i <interface> -A \'tcp port 80 and (((ip dst <router_ip>) and (tcp[32:4] contains "/goform/setBlackRule")))\''}, {'type': 'list_item', 'content': "Use curl or similar HTTP clients to test the endpoint with crafted 'deviceList' parameters to see if the device responds abnormally or crashes."}, {'type': 'list_item', 'content': "Deploy IDS rules that detect unusually long or malformed 'deviceList' parameters in HTTP POST requests to '/goform/setBlackRule'."}] [1, 2, 3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'No known mitigations or patches are currently available for this vulnerability.'}, {'type': 'paragraph', 'content': 'The recommended immediate step is to replace the affected Tenda A18 router (firmware version 15.13.07.13) with an alternative product that is not vulnerable.'}, {'type': 'paragraph', 'content': "Additionally, you should restrict remote access to the router's management interface to trusted networks only, and monitor for any suspicious activity targeting the '/goform/setBlackRule' endpoint."}, {'type': 'paragraph', 'content': 'Implement network-level protections such as firewalls or intrusion prevention systems to block exploit attempts.'}] [1, 3]