Executive brief
A security vulnerability exists in the Tenda AC18 wireless router's web management interface. An attacker can exploit this flaw by sending a specially crafted web request to the device, which could cause the router to crash or allow the attacker to take full control of the device. This could lead to a complete loss of internet connectivity or unauthorized access to the home or business network.
Technical details
A stack-based buffer overflow vulnerability exists in the Tenda AC18 router (firmware V15.03.05.05) within the 'sub_45304' function of the '/goform/getRebootStatus' endpoint. The vulnerability is caused by the unsafe use of 'sprintf' when processing the user-supplied 'callback' parameter, which is concatenated into a fixed 64-byte stack buffer without length validation. A remote attacker with access to the web management interface can provide an overly long string to overwrite the saved frame pointer and return address. Successful exploitation can result in a crash of the web service or arbitrary remote code execution (RCE). A public exploit (PoC) is available.
Affected products
- Tenda AC18 Wireless Router 15.03.05.05
Timeline
- 2026-06-08: disclosed: Vulnerability disclosed via VulDB and NVD
- 2026-06-08: advisory