Cyber Posture

CVE-2026-3044

High

Published: 24 February 2026

Published
24 February 2026
Modified
24 February 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0010 27.4th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability has been found in Tenda AC8 16.03.34.06. This affects the function webCgiGetUploadFile of the file /cgi-bin/UploadCfg of the component Httpd Service. The manipulation of the argument boundary leads to stack-based buffer overflow. It is possible to initiate the…

more

attack remotely. The exploit has been disclosed to the public and may be used.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly requires identification, reporting, and correction of the stack-based buffer overflow flaw in the webCgiGetUploadFile function via firmware patching.

SI-10 Information Input Validation good match
prevent

Mandates validation of untrusted inputs like the boundary argument to prevent improper restriction of operations within memory bounds leading to overflow.

SI-16 Memory Protection good match
prevent

Implements memory protection mechanisms such as stack canaries and non-executable stacks to mitigate exploitation of stack-based buffer overflows.

Security SummaryAI

CVE-2026-3044 is a stack-based buffer overflow vulnerability in the Tenda AC8 router running firmware version 16.03.34.06. The issue resides in the webCgiGetUploadFile function within the /cgi-bin/UploadCfg file of the Httpd Service component. By manipulating the "boundary" argument, an attacker can trigger the overflow, as classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow). The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

A remote attacker with low privileges can exploit this vulnerability without user interaction and with low complexity. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, potentially leading to remote code execution on the affected device.

Advisories and details are documented in references including a GitHub issue at https://github.com/master-abc/cve/issues/43 and VulDB entries at https://vuldb.com/?ctiid.347400, https://vuldb.com/?id.347400, and https://vuldb.com/?submit.757240, with the vendor site at https://www.tenda.com.cn/. No specific patch or mitigation details are provided in the CVE description.

The exploit has been publicly disclosed and may be used, as noted in the vulnerability report published on 2026-02-24.

Details

CWE(s)
CWE-119CWE-121

Affected Products

tenda
ac8 firmware
16.03.34.06

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Stack buffer overflow in exposed Httpd/CGI web interface (AV:N, PR:L) directly enables remote exploitation of a public-facing application for RCE and subsequent privilege escalation to full device control.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

References