Is CVE-2026-5567 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5567 being exploited in the wild.

How severe is CVE-2026-5567?

High severity, with a CVSS score of 8.8, published 5 April 2026.

Which products and versions are affected?

Tenda M3 Access Controller 1.0.0.10.

Is there a fix for CVE-2026-5567?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5567 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-5567?

Check whether you run Tenda M3, Tenda M3 Access Controller or Tenda M3 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5567: Tenda M3 buffer overflow in setAdvPolicyData

CVE-2026-5567 · Severity: high · CVSS 8.8 · Published 2026-04-05

A security vulnerability has been identified in the Tenda M3 Access Controller, a device used to manage wireless networks. An attacker can exploit this flaw to cause the device to crash or stop responding, leading to a denial of service. In some cases, this could allow for further unauthorized access or disruption of the managed network infrastructure.

Technologies: Tenda M3, Tenda M3 Firmware. Vendors: Tenda.

Quick answers

Is CVE-2026-5567 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5567 being exploited in the wild.
How severe is CVE-2026-5567?: High severity, with a CVSS score of 8.8, published 5 April 2026.
Which products and versions are affected?: Tenda M3 Access Controller 1.0.0.10.
Is there a fix for CVE-2026-5567?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5567 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-5567?: Check whether you run Tenda M3, Tenda M3 Access Controller or Tenda M3 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow exists in the 'setAdvPolicyData' function of Tenda M3 firmware version 1.0.0.10, specifically within the 'sub_648D4' subroutine. The vulnerability is caused by an unsafe 'strncpy' operation where the length parameter is calculated from the position of a colon character in the user-controlled 'rebootTime' parameter without validating the destination buffer size. A remote attacker with low privileges can exploit this by sending a specially crafted POST request to '/goform/setAdvPolicyData'. Successful exploitation can lead to a crash of the web management service, device-wide denial of service (DoS), or potential remote code execution. A public exploit (PoC) is available.

Affected products

Tenda M3 Access Controller 1.0.0.10

Timeline

2026-03-19: disclosed: Vulnerability details and PoC published on GitHub by researcher Moxxkidd.
2026-04-05: advisory: CVE-2026-5567 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.