CVE-2026-3400
Stack-Based Buffer Overflow in Tenda AC15 Remote Exploit
Publication date: 2026-03-02
Last updated on: 2026-03-03
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | ac15_firmware | to 15.13.07.13 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-3400 is a stack-based buffer overflow vulnerability found in the Tenda AC15 router firmware versions up to 15.13.07.13.
The flaw exists in an unspecified part of the file /goform/TextEditingConversion, specifically triggered by manipulating the argument wpapsk_crypto2_4g with crafted input.
This manipulation causes the router to overflow a buffer allocated on the stack, which can lead to arbitrary code execution or denial of service.
The vulnerability can be exploited remotely without requiring local access or physical interaction, and a proof-of-concept exploit is publicly available.
How can this vulnerability impact me? :
Exploitation of this vulnerability can allow remote attackers to execute arbitrary code on the affected Tenda AC15 router or cause a denial of service.
This means attackers could potentially take control of the router, disrupt network connectivity, or compromise the confidentiality, integrity, and availability of the device.
Since the router is a critical network device, such compromise could affect all devices connected through it.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection commands or network/system detection methods provided for this vulnerability in the available information.
What immediate steps should I take to mitigate this vulnerability?
No official vendor patch or advisory has been released for this vulnerability.
It is recommended to replace the affected product or firmware version to mitigate the risk.