CVE-2026-2908
Remote Stack-Based Buffer Overflow in Tenda HG9 Loopback Endpoint
Publication date: 2026-02-22
Last updated on: 2026-02-23
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | hg9_firmware | 300001138 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-2908 is a critical stack-based buffer overflow vulnerability found in the Tenda HG9 router firmware version 300001138. It affects the Loopback Detection Configuration Endpoint located at /boaform/formLoopBack. The vulnerability arises from improper handling of the Ethtype parameter when the apply parameter is present.'}, {'type': 'paragraph', 'content': 'The vulnerable code uses the unsafe function sprintf to format the Ethtype input as a hexadecimal string prefixed with "0x" into a fixed-size local stack buffer of only 8 bytes. The code expects a 2-byte hexadecimal Ethernet type (e.g., "0800"), which results in a 6-byte string ("0x0800"). However, there is no input length validation, so if an attacker supplies an Ethtype string longer than 5 bytes, sprintf writes beyond the buffer boundary, causing a stack overflow.'}, {'type': 'paragraph', 'content': 'This overflow can overwrite adjacent stack variables, including the saved return address, potentially allowing an attacker to control execution flow and execute arbitrary code with root privileges. The attack can be executed remotely without local access.'}] [1, 2, 3]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can have severe impacts including Denial of Service (DoS) and Remote Code Execution (RCE).'}, {'type': 'list_item', 'content': "Denial of Service: Sending an Ethtype string longer than 8 bytes corrupts the stack and crashes the HTTP daemon, causing the router's web interface to become unavailable."}, {'type': 'list_item', 'content': 'Remote Code Execution: By overwriting the return address on the stack, an attacker can hijack the control flow and execute arbitrary code with root privileges on the device.'}, {'type': 'paragraph', 'content': 'Because the exploit is remotely executable and publicly available, attackers can easily exploit this vulnerability to compromise the device, potentially gaining full control over it.'}] [1, 2, 3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by sending a crafted POST request to the vulnerable endpoint /boaform/formLoopBack on the Tenda HG9 router, specifically targeting the Ethtype parameter with an overly long string when the apply parameter is set.'}, {'type': 'paragraph', 'content': "A proof-of-concept involves sending a POST request with parameters apply=1 and Ethtype set to a long string (e.g., 100 'A' characters) which triggers the stack-based buffer overflow and crashes the HTTP daemon."}, {'type': 'paragraph', 'content': 'Example command using curl to test the vulnerability:'}, {'type': 'list_item', 'content': 'curl -X POST http://<router-ip>/boaform/formLoopBack -d "apply=1&Ethtype=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"'}, {'type': 'paragraph', 'content': 'If the service crashes or becomes unresponsive after this request, it indicates the presence of the vulnerability.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Avoid sending or accepting Ethtype parameter values longer than 4 characters to prevent triggering the buffer overflow.
- Restrict access to the /boaform/formLoopBack endpoint by network segmentation or firewall rules to limit exposure.
- Monitor the device for crashes or unusual behavior indicating exploitation attempts.
Long-term remediation involves updating the firmware to a version where the vulnerable sprintf call is replaced with a safe function like snprintf, input length validation is enforced, or the buffer size is increased.
If no firmware update is available, consider replacing the affected device to avoid exploitation.