# CVE-2026-51380: Tenda AC10 v3 buffer overflow in UploadCfg

Source: https://junglewise.ai/threats/cve-2026-51380-tenda-ac10-v3-buffer-overflow-in-uploadcfg  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-51380 · Severity: info · Published 2026-07-15

A vulnerability exists in the Tenda AC10 v3.0 router, a device used to provide wireless internet access. By uploading a specially crafted configuration file, an attacker can cause the router to enter a permanent 'brick' state where it becomes completely unresponsive and cannot be fixed using the physical reset button. This results in a permanent loss of internet connectivity and requires hardware-level repairs or replacement of the device.

Technologies: [Tenda AC10](https://junglewise.ai/threats/technologies/ac10). Vendors: [Tenda](https://junglewise.ai/threats/vendors/tenda).

## Quick answers

**Is CVE-2026-51380 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-51380 being exploited in the wild.

**How severe is CVE-2026-51380?** Informational severity, published 15 July 2026.

**Which products and versions are affected?** Tenda AC10 V03.03.16.09.

**Is there a fix for CVE-2026-51380?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-51380 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-51380?** Check whether you run Tenda AC10 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the Tenda AC10 v3.0 (firmware V03.03.16.09) within the configuration restoration mechanism. The vulnerability is located in the /cgi-bin/UploadCfg endpoint, which fails to properly validate the length of user-supplied strings before passing them to the internal nvram_set function (specifically via FUN_80047190). Although the router attempts to verify configuration integrity, it uses a weak ASCII summation checksum that is easily bypassed. An attacker can provide an oversized string for parameters like 'wan0_macclone_mode', leading to memory corruption. Because the corrupted configuration is stored in NVRAM and processed early in the boot cycle, the device enters an infinite crash loop (bootloop) that occurs before GPIO handlers are initialized, rendering the physical reset button non-functional. As of the advisory date, the vendor has not provided a patch.

## Affected products

- Tenda AC10 v3.0 V03.03.16.09

## Timeline

- 2026-03-27: disclosed: Vulnerability discovered by researcher
- 2026-07-15: advisory: Public disclosure after 60-day non-responsive period

## References

- [https://github.com/snyi001/CV/blob/main/11.zip](https://github.com/snyi001/CV/blob/main/11.zip)
- [https://github.com/snyi001/Tenda-AC10-v3](https://github.com/snyi001/Tenda-AC10-v3)
- [https://www.tendacn.com/material/show/104968](https://www.tendacn.com/material/show/104968)

## Related threats

- [Tenda AC10 stack buffer overflow in fromAdvSetLanip](https://junglewise.ai/threats/cve-2026-16248-tenda-ac10-stack-buffer-overflow-in-fromadvsetlanip)
- [Tenda AC10 stack buffer overflow in fromSysToolChangePwd](https://junglewise.ai/threats/cve-2026-5550-tenda-ac10-stack-buffer-overflow-in-fromsystoolchangepwd)
- [Tenda AC10 hard-coded RSA private key in webroot](https://junglewise.ai/threats/cve-2026-5549-tenda-ac10-hard-coded-rsa-private-key-in-webroot)
- [Tenda AC10 stack overflow in fromSysToolChangePwd](https://junglewise.ai/threats/cve-2026-5548-tenda-ac10-stack-overflow-in-fromsystoolchangepwd)
- [Tenda AC10 OS command injection in formAddMacfilterRule](https://junglewise.ai/threats/cve-2026-5547-tenda-ac10-os-command-injection-in-formaddmacfilterrule)