Cyber Posture

CVE-2026-2905

HighPublic PoC

Published: 22 February 2026

Published
22 February 2026
Modified
23 February 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 29.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was identified in Tenda HG9 300001138. This impacts an unknown function of the file /boaform/formWlanSetup of the component Wireless Configuration Endpoint. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack may be initiated remotely.…

more

The exploit is publicly available and might be used.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of the SSID argument to prevent stack-based buffer overflows from improper input handling in the wireless configuration endpoint.

SI-16 Memory Protection good match
prevent

Implements memory protection mechanisms like stack canaries and address space layout randomization to mitigate exploitation of stack-based buffer overflows even if input validation fails.

SI-2 Flaw Remediation good match
preventrecover

Mandates timely identification, reporting, and patching of the specific buffer overflow flaw in the Tenda HG9 firmware's /boaform/formWlanSetup endpoint.

Security SummaryAI

CVE-2026-2905 is a stack-based buffer overflow vulnerability affecting the Tenda HG9 router with firmware version 300001138. The flaw resides in an unknown function within the /boaform/formWlanSetup file of the Wireless Configuration Endpoint component, triggered by manipulation of the "ssid" argument. Published on 2026-02-22, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).

An attacker with low privileges can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing arbitrary code execution on the affected device.

Advisories and details are available via VulDB entries (ctiid.347214, id.347214, submit.755167) and a GitHub issue at QIU-DIE/cve-nneeww/issues/7, with the vendor site at www.tenda.com.cn/. A public exploit is available and might be used in attacks.

Details

CWE(s)
CWE-119CWE-121

Affected Products

tenda
hg9 firmware
300001138

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Buffer overflow in public-facing router web interface (/boaform/formWlanSetup) enables remote exploitation (T1190); low privileges required with potential for arbitrary code execution indicates privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References