Executive brief
The Tenda W6-S wireless access point contains a security flaw in its web management interface. By sending a specially crafted request to the device's Wi-Fi configuration settings, an attacker could potentially crash the device or take control of it. This could lead to a complete loss of network connectivity or unauthorized access to the internal network.
Technical details
A stack-based buffer overflow exists in the Tenda W6-S firmware version 1.0.0.4(510). The vulnerability is located within the 'formwrlSSIDset' function, which handles requests to the '/goform/wifiSSIDset' endpoint. The function utilizes 'sprintf' to copy the user-provided 'GO' and 'index' HTTP parameters into a fixed 64-byte stack buffer without performing any length validation. An attacker can exploit this by sending overly long strings in these parameters to overwrite the stack, potentially leading to arbitrary code execution or a denial-of-service (DoS) condition. The attack can be launched over the network, typically requiring access to the device's web management interface.
Affected products
- Tenda W6-S 1.0.0.4(510)
Timeline
- 2026-07-31: disclosed
- 2026-07-31: advisory