CVE-2026-3044
Stack-Based Buffer Overflow in Tenda AC8 Httpd Service
Publication date: 2026-02-24
Last updated on: 2026-02-24
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | ac8_firmware | 16.03.34.06 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-3044 is a stack-based buffer overflow vulnerability found in the Tenda AC8 router firmware version 16.03.34.06. It affects the function webCgiGetUploadFile within the Httpd Service component, specifically at the /cgi-bin/UploadCfg endpoint.'}, {'type': 'paragraph', 'content': "The vulnerability arises because the 'boundary' parameter, extracted from the Content-Type header of HTTP POST requests, is not properly validated for length. An attacker can send a crafted request with an excessively long 'boundary' value, causing a fixed-size stack buffer (64 bytes) to overflow."}, {'type': 'paragraph', 'content': 'This overflow can lead to remote code execution or denial of service on the affected device.'}] [1, 2, 3]
How can this vulnerability impact me? :
Exploiting this vulnerability allows a remote attacker to execute arbitrary code on the affected Tenda AC8 router or cause a denial of service (DoS).
This means the attacker could potentially take control of the device, disrupt its normal operation, or crash it, leading to loss of network connectivity or compromised network security.
Since the vulnerability affects confidentiality, integrity, and availability of the device, it poses a significant security risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring HTTP POST requests to the /cgi-bin/UploadCfg endpoint on Tenda AC8 routers running firmware version 16.03.34.06. Specifically, look for requests containing a Content-Type header with a boundary parameter that is unusually long or malformed, as this triggers the stack-based buffer overflow.'}, {'type': 'paragraph', 'content': 'A practical detection method is to capture and analyze network traffic targeting the vulnerable router, focusing on POST requests to /cgi-bin/UploadCfg and inspecting the boundary parameter length in the Content-Type header.'}, {'type': 'paragraph', 'content': 'Example command using tcpdump to capture relevant HTTP POST requests:'}, {'type': 'list_item', 'content': "tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -i 'POST /cgi-bin/UploadCfg'"}, {'type': 'paragraph', 'content': 'After capturing, inspect the Content-Type headers for the boundary parameter length. Alternatively, use tools like Wireshark to filter HTTP POST requests to /cgi-bin/UploadCfg and examine the boundary parameter.'}] [1, 3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Currently, no known countermeasures or mitigations have been identified for this vulnerability.'}, {'type': 'paragraph', 'content': "Immediate steps include restricting access to the affected device's management interface, especially blocking remote HTTP POST requests to the /cgi-bin/UploadCfg endpoint."}, {'type': 'paragraph', 'content': 'Consider replacing the affected Tenda AC8 router with a device that is not vulnerable or applying any available firmware updates if released by the vendor.'}, {'type': 'paragraph', 'content': 'Monitor network traffic for exploit attempts and apply network-level protections such as firewall rules to block suspicious requests targeting the vulnerable endpoint.'}] [2]