# CVE-2026-5550: Tenda AC10 stack buffer overflow in fromSysToolChangePwd

Source: https://junglewise.ai/threats/cve-2026-5550-tenda-ac10-stack-buffer-overflow-in-fromsystoolchangepwd  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-05. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-5550 · Severity: high · CVSS 8.8 · Published 2026-04-05

A security vulnerability has been identified in the Tenda AC10 router, a device used to provide wireless internet in homes and small offices. An attacker could exploit this flaw to crash the router or potentially take full control of the device. This could lead to unauthorized access to the network, interception of internet traffic, or a complete loss of internet connectivity for the user.

Technologies: [Tenda AC10](https://junglewise.ai/threats/technologies/ac10), [Tenda AC10 firmware](https://junglewise.ai/threats/technologies/ac10-firmware). Vendors: [Tenda](https://junglewise.ai/threats/vendors/tenda).

## Quick answers

**Is CVE-2026-5550 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5550 being exploited in the wild.

**How severe is CVE-2026-5550?** High severity, with a CVSS score of 8.8, published 5 April 2026.

**Which products and versions are affected?** Tenda AC10 16.03.10.10_multi_TDE01.

**Is there a fix for CVE-2026-5550?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5550 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-5550?** Check whether you run Tenda AC10 or Tenda AC10 firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow vulnerability exists in the Tenda AC10 router (firmware version 16.03.10.10_multi_TDE01) within the 'fromSysToolChangePwd' function of the /bin/httpd binary. The root cause is a systemic failure in the 'GetValue()' API, which retrieves configuration values from NVRAM and copies them into fixed-size stack buffers (ranging from 16 to 64 bytes) without length validation. An attacker with network access and low-level privileges can trigger this overflow by providing oversized values. Because the binary lacks stack canaries and Address Space Layout Randomization (ASLR), this vulnerability can be reliably exploited for remote code execution. Static analysis indicates over 200 other call sites may be similarly affected.

## Affected products

- Tenda AC10 16.03.10.10_multi_TDE01

## Timeline

- 2026-04-05: disclosed: Vulnerability first reported/published
- 2026-04-05: advisory

## References

- [https://github.com/somanyerrors/tenda-ac10v4-vulnerabilities/blob/main/findings/HIGH-01-getvalue-229-callers.md](https://github.com/somanyerrors/tenda-ac10v4-vulnerabilities/blob/main/findings/HIGH-01-getvalue-229-callers.md)
- [https://vuldb.com/submit/782299](https://vuldb.com/submit/782299)
- [https://vuldb.com/vuln/355314](https://vuldb.com/vuln/355314)
- [https://vuldb.com/vuln/355314/cti](https://vuldb.com/vuln/355314/cti)
- [https://www.tenda.com.cn/](https://www.tenda.com.cn/)

## Related threats

- [Tenda AC10 stack buffer overflow in fromAdvSetLanip](https://junglewise.ai/threats/cve-2026-16248-tenda-ac10-stack-buffer-overflow-in-fromadvsetlanip)
- [Tenda AC10 v3 buffer overflow in UploadCfg](https://junglewise.ai/threats/cve-2026-51380-tenda-ac10-v3-buffer-overflow-in-uploadcfg)
- [Tenda Firmware authentication backdoor in httpd login function](https://junglewise.ai/threats/cve-2026-11405-tenda-firmware-authentication-backdoor-in-httpd-login-function)
- [Tenda AC10 hard-coded RSA private key in webroot](https://junglewise.ai/threats/cve-2026-5549-tenda-ac10-hard-coded-rsa-private-key-in-webroot)
- [Tenda AC10 stack overflow in fromSysToolChangePwd](https://junglewise.ai/threats/cve-2026-5548-tenda-ac10-stack-overflow-in-fromsystoolchangepwd)