CVE-2026-2908
Published: 22 February 2026
Description
A security vulnerability has been detected in Tenda HG9 300001138. Affected by this issue is some unknown functionality of the file /boaform/formLoopBack of the component Loopback Detection Configuration Endpoint. Such manipulation of the argument Ethtype leads to stack-based buffer overflow.…
more
The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Mitigating Controls (NIST 800-53 r5)AI
Timely firmware remediation directly patches the stack-based buffer overflow in the Tenda HG9 router's /boaform/formLoopBack Loopback Detection Configuration Endpoint.
Validates the Ethtype argument to prevent stack-based buffer overflow exploitation in the Loopback Detection Configuration Endpoint.
Deploys memory protections such as stack canaries to block arbitrary code execution from the Ethtype-induced buffer overflow.
Security SummaryAI
CVE-2026-2908 is a stack-based buffer overflow vulnerability (CWE-119, CWE-121) affecting the Tenda HG9 router with firmware version 300001138, published on 2026-02-22. The flaw resides in an unknown functionality of the /boaform/formLoopBack file within the Loopback Detection Configuration Endpoint, where manipulation of the Ethtype argument triggers the overflow.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited remotely with low complexity by an attacker possessing low privileges, without requiring user interaction. Successful exploitation could grant high-impact access to confidentiality, integrity, and availability, potentially enabling arbitrary code execution through the buffer overflow.
Advisories and additional details are documented in references such as https://github.com/QIU-DIE/cve-nneeww/issues/10, https://vuldb.com/?ctiid.347217, https://vuldb.com/?id.347217, https://vuldb.com/?submit.755202, and the vendor site https://www.tenda.com.cn/. The exploit has been publicly disclosed and may be usable.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remotely exploitable buffer overflow in a public-facing web management endpoint (/boaform/formLoopBack) on a router, enabling arbitrary code execution, which directly maps to Exploit Public-Facing Application (T1190).