CVE-2026-16248
Deferred Deferred - Pending Action

Stack-Based Buffer Overflow in Tenda AC10 Router Firmware

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulDB

Description
A vulnerability was found in Tenda AC10 16.03.10.09_multi_TDE01. This issue affects the function fromAdvSetLanip of the file /goform/AdvSetLanip of the component httpd/netctrl. The manipulation of the argument GetValue/SetValue results in stack-based buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-16248
EUVD
EUVD-2026-45942

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tenda ac10 From 16.03.10.09 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stack-based buffer overflow in the Tenda AC10 router's web management interface. The vulnerability occurs in the function fromAdvSetLanip which handles LAN IP settings. When an oversized parameter like lanMask is submitted via the web interface, it gets stored in NVRAM without proper size validation. Later, when retrieved, the value is copied into a fixed-size stack buffer without checking the destination capacity, causing a buffer overflow that crashes the httpd daemon.

Detection Guidance

Check if your Tenda AC10 router is running firmware version US_AC10V4.0si_V16.03.10.09_multi_TDE01.bin or similar. Test the vulnerability by sending oversized parameters like lanMask=1000 bytes to the /goform/AdvSetLanip endpoint via HTTP POST requests. Monitor for crashes in the httpd daemon or unusual behavior in the web interface.

Impact Analysis

An authenticated administrator could exploit this to crash the router's web interface or httpd daemon, causing a denial of service. While arbitrary code execution is theoretically possible, it has not been confirmed. The attack can be performed remotely if the router's web interface is accessible.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive network configurations. An attacker exploiting the stack-based buffer overflow might gain control over the router's settings, potentially exposing or manipulating network traffic. For GDPR, this could lead to unauthorized data processing or breaches. For HIPAA, it might compromise protected health information transmitted through the network. The lack of input validation and buffer overflow conditions create risks of data exfiltration or service disruption, both of which are critical compliance concerns.

Mitigation Strategies

Update the router firmware to a patched version if available. Restrict access to the web management interface to trusted networks only. Disable remote administration if not required. Monitor for unusual traffic or crashes in the httpd daemon.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16248. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart