Executive brief
A security vulnerability has been identified in Tenda AC6 and AC10U routers, which are devices used to provide wireless internet connectivity. An attacker can exploit this flaw to take control of the router remotely, potentially leading to unauthorized access to network traffic or a complete disruption of internet services. Because an exploit for this issue is publicly available, the risk of unauthorized parties attempting to compromise these devices is elevated.
Technical details
A vulnerability exists in the 'fromSetWirelessRepeat' function within the '/goform/WifiExtraSet' (or '/goform/fromSetWirelessRepeat') endpoint of the Tenda AC6 and AC10U httpd component. The issue stems from improper neutralization of special elements in the 'mac', 'ssid', or 'wpapsk_crypto' parameters, leading to OS command injection and a stack-based buffer overflow via 'strcpy' without length validation. A remote attacker can exploit this by sending a specially crafted HTTP POST request to the device. Successful exploitation allows for arbitrary command execution with the privileges of the web server. While some sources suggest high privileges are required, others indicate the endpoint may be reachable without authentication; a public PoC has been released.
Affected products
- Tenda AC6 15.03.06.49_multi_TDE01
- Tenda AC10U 15.03.06.49_multi_TDE01
Timeline
- 2026-05-11: advisory: Initial disclosure by VulDB and NVD
- 2026-05-11: other: Public exploit released