CVE-2026-2877
Published: 21 February 2026
Description
A vulnerability has been found in Tenda A18 15.13.07.13. This affects the function strcpy of the file /goform/WifiExtraSet of the component Httpd Service. The manipulation of the argument wpapsk_crypto5g leads to stack-based buffer overflow. It is possible to initiate the…
more
attack remotely. The exploit has been disclosed to the public and may be used.
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of the stack-based buffer overflow flaw in the Tenda A18 httpd service via firmware patching.
Mandates validation of the wpapsk_crypto5g input argument to prevent triggering the strcpy buffer overflow in the WifiExtraSet handler.
Implements memory protections such as stack canaries and non-executable stacks to mitigate exploitation of the stack-based buffer overflow.
Security SummaryAI
CVE-2026-2877 is a stack-based buffer overflow vulnerability affecting the Tenda A18 router on firmware version 15.13.07.13, published on 2026-02-21. The flaw exists in the strcpy function within the /goform/WifiExtraSet file of the Httpd Service component, triggered by manipulation of the wpapsk_crypto5g argument. It is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability enables remote exploitation by an attacker possessing low privileges, such as an authenticated user on the network. No user interaction is required, and successful exploitation can result in high-impact compromise of confidentiality, integrity, and availability, potentially allowing arbitrary code execution on the affected device.
Advisories from VulDB (https://vuldb.com/?ctiid.347130, https://vuldb.com/?id.347130, https://vuldb.com/?submit.754703) provide further details on the issue, while the vendor site (https://www.tenda.com.cn/) may offer patching guidance. An exploit has been publicly disclosed on GitHub (https://github.com/master-abc/cve/issues/39) and may be in use.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the router's Httpd web service (/goform/WifiExtraSet) allows remote authenticated attackers to achieve arbitrary code execution, directly facilitating exploitation of a public-facing application.