Cyber Posture

CVE-2026-2139

HighPublic PoC

Published: 08 February 2026

Published
08 February 2026
Modified
10 February 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 29.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was determined in Tenda TX9 up to 22.03.02.10_multi. Affected by this vulnerability is the function sub_432580 of the file /goform/fast_setting_wifi_set. This manipulation of the argument ssid causes buffer overflow. The attack may be initiated remotely. The exploit has…

more

been publicly disclosed and may be utilized.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Validates the ssid argument in the /goform/fast_setting_wifi_set CGI endpoint to prevent buffer overflow from malformed or oversized inputs.

SI-2 Flaw Remediation good match
prevent

Remediates the known buffer overflow flaw in Tenda TX9 firmware up to 22.03.02.10_multi through patching or equivalent fixes.

SI-16 Memory Protection good match
prevent

Implements memory safeguards like stack canaries or DEP to protect against exploitation of the buffer overflow even if input validation fails.

Security SummaryAI

CVE-2026-2139 is a buffer overflow vulnerability (CWE-119, CWE-120) affecting Tenda TX9 routers with firmware versions up to 22.03.02.10_multi. The flaw exists in the sub_432580 function of the /goform/fast_setting_wifi_set CGI endpoint, where manipulation of the ssid argument triggers the overflow. Published on 2026-02-08, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

The vulnerability can be exploited remotely by an attacker with low privileges, requiring no user interaction. Successful exploitation enables high-impact consequences, including potential arbitrary code execution, data compromise, modification, or denial of service on the affected device.

Advisories and references, including GitHub analysis at MRAdera/IoT-Vuls and VulDB entries (ctiid.344774, id.344774), detail the issue and provide a proof-of-concept exploit. The exploit has been publicly disclosed and may be utilized, but no specific patches or vendor mitigations are mentioned in the available information.

The public disclosure of the exploit increases the risk for unpatched Tenda TX9 deployments in home or small office environments.

Details

CWE(s)
CWE-119CWE-120

Affected Products

tenda
tx9 firmware
≤ 22.03.02.10

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Buffer overflow in public-facing CGI endpoint (/goform/fast_setting_wifi_set) enables exploitation of public-facing application (T1190) remotely with low privileges, leading to arbitrary code execution which facilitates privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References