CVE-2026-4567
Stack-Based Buffer Overflow in Tenda A15 UploadCfg CGI
Publication date: 2026-03-23
Last updated on: 2026-04-02
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | a15_firmware | 15.13.07.13 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-4567 is a stack-based buffer overflow vulnerability found in the Tenda A15 router firmware version 15.13.07.13. It occurs in the UploadCfg function of the /cgi-bin/UploadCfg endpoint. The vulnerability arises because the input argument 'File' is not properly validated or limited in size, allowing an attacker to overflow the stack buffer."}, {'type': 'paragraph', 'content': 'This flaw can be exploited remotely without any authentication, meaning an attacker can send specially crafted requests to the device and trigger the overflow.'}, {'type': 'paragraph', 'content': 'Exploitation of this vulnerability may lead to arbitrary code execution or denial of service on the affected device.'}] [1, 2]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including allowing a remote attacker to execute arbitrary code on the affected Tenda A15 router without any authentication.
Such unauthorized code execution could lead to full compromise of the device, enabling the attacker to control the router, intercept or manipulate network traffic, or disrupt network services.
Additionally, exploitation can cause denial of service, making the device unavailable to legitimate users.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves an unauthenticated stack-based buffer overflow in the /cgi-bin/UploadCfg endpoint of the Tenda A15 router firmware version 15.13.07.13. Detection would typically involve monitoring for suspicious HTTP requests targeting the /cgi-bin/UploadCfg path with unusually large or malformed File arguments.'}, {'type': 'paragraph', 'content': 'Since no specific detection commands or signatures are provided in the available resources, general network monitoring tools like tcpdump or Wireshark can be used to capture HTTP traffic to the device, filtering for requests to /cgi-bin/UploadCfg.'}, {'type': 'list_item', 'content': "Use tcpdump to capture HTTP requests to the vulnerable endpoint: tcpdump -i <interface> 'tcp port 80 and (((ip dst <router_ip>) and (tcp[32:4] = 0x2f636769)))'"}, {'type': 'list_item', 'content': 'Use curl or similar tools to test the endpoint manually by sending crafted requests to /cgi-bin/UploadCfg and observe the device behavior.'}, {'type': 'paragraph', 'content': 'However, no specific detection scripts or commands are provided in the available information.'}] [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps are not explicitly detailed in the provided resources. However, general best practices for this type of vulnerability include:
- Restrict network access to the vulnerable device, especially blocking external access to the /cgi-bin/UploadCfg endpoint.
- Apply any available firmware updates or patches from the vendor addressing this vulnerability.
- If no patch is available, consider disabling the vulnerable service or CGI endpoint if possible.
- Monitor the device for unusual behavior or crashes that may indicate exploitation attempts.
Since the vulnerability allows remote unauthenticated exploitation, limiting exposure and applying vendor fixes are critical.