CVE-2026-4043
Stack-Based Buffer Overflow in Tenda i12 WiFi Function
Publication date: 2026-03-12
Last updated on: 2026-04-02
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | i12_firmware | 1.0.0.6(2204) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-4043 is a stack-based buffer overflow vulnerability found in the Tenda i12 router firmware version 1.0.0.6(2204). It exists in the function formwrlSSIDget within the /goform/wifiSSIDget endpoint. The vulnerability occurs because the function processes user-supplied parameters "wl_radio" and "index" without proper bounds checking. Specifically, when "wl_radio" is set to a value other than 0, a variable is passed to the sprintf function without validating its length, allowing an attacker to overflow the stack buffer.'}, {'type': 'paragraph', 'content': 'This flaw can be exploited remotely by sending a crafted POST request with an excessively long "index" parameter, leading to stack memory corruption. The vulnerability can cause denial of service (DoS) or enable remote code execution (RCE) on the affected device.'}] [1, 2, 3]
How can this vulnerability impact me? :
Exploitation of this vulnerability can have serious impacts including denial of service (DoS), where the device becomes unresponsive or crashes, and remote code execution (RCE), where an attacker can execute arbitrary code on the device remotely.
This means an attacker could potentially take control of the affected router, disrupt network services, intercept or manipulate network traffic, or use the device as a foothold for further attacks within a network.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for suspicious POST requests sent to the /goform/wifiSSIDget endpoint, especially those containing an excessively long or malformed "index" parameter.'}, {'type': 'paragraph', 'content': 'A practical detection method is to capture and analyze HTTP traffic targeting the Tenda i12 router, looking for POST requests where the "index" parameter is unusually large or crafted to trigger the buffer overflow.'}, {'type': 'paragraph', 'content': 'Example command using curl to test the vulnerability by sending a crafted POST request:'}, {'type': 'list_item', 'content': 'curl -X POST http://[router-ip]/goform/wifiSSIDget -d "wl_radio=1&index=$(python3 -c \'print("A"*1000)\')"'}, {'type': 'paragraph', 'content': 'Network intrusion detection systems (NIDS) can be configured to alert on such anomalous POST requests with large payloads to this endpoint.'}] [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting remote access to the affected Tenda i12 router, especially blocking or filtering HTTP POST requests to the /goform/wifiSSIDget endpoint.
Since no known mitigations or patches are currently available, it is recommended to replace the affected device with an alternative product to avoid the risk of exploitation.
Additionally, monitoring network traffic for exploit attempts and disabling any unnecessary services on the router can reduce exposure.