Executive brief
Tenda AC1206 routers contain a vulnerability in the web management interface that allows attackers to remotely crash the device or execute malicious code by sending a specially crafted request with an oversized device name parameter. This affects the router's ability to remain operational and could allow attackers to take control of the network equipment used to protect and manage office or home networks.
Technical details
A stack-based buffer overflow exists in the set_device_name function within the httpd web management interface (/goform/SetOnlineDevName). The vulnerable component reads an unchecked devName parameter from user input and writes it directly into a fixed 256-byte stack buffer using sprintf without length validation. An unauthenticated attacker can exploit this remotely by sending a POST request with a devName value longer than the buffer size, overwriting the stack and achieving remote code execution or denial of service. No authentication is required; the exploit is network-reachable and public. Patches are not mentioned as available.
Affected products
- Tenda AC1206 15.03.06.23_multi_TD01
Timeline
- 2026-08-14: disclosed
- other: Exploit made public