CVE-2026-2137

Tenda TX3 SetIpMacBind buffer overflow

View on CVE.org
Published Feb 8, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
A vulnerability has been found in Tenda TX3 up to 16.03.13.11_multi. This impacts an unknown function of the file /goform/SetIpMacBind. The manipulation of the argument list leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Analysis

AI-generated

Technical impact

A buffer overflow flaw exists in the Tenda TX3 router’s /goform/SetIpMacBind endpoint. The flaw is triggered by malicious manipulation of the function’s argument list, which allows an attacker to corrupt memory. This memory corruption can potentially lead to arbitrary code execution, compromising the confidentiality, integrity, and availability of the device and any networks it manages. The weakness is a classic stack-based buffer overflow (CWE-119 and CWE-120).

Affected Systems

Tenda TX3 routers running firmware versions up to 16.03.13.11_multi are affected. The issue lies in the web management interface and can impact any unit still on those firmware releases.

Risk and Exploitability

The CVSS score is 8.7, indicating high severity. EPSS is reported as less than 1 %, showing a low global exploitation probability at this time, and the vulnerability is not currently listed in the CISA KEV catalog. Nevertheless, the attack can be launched remotely via the HTTP interface, likely by sending crafted requests to the SetIpMacBind endpoint. Because the flaw is not limited by network boundaries it can be abused from external networks provided remote management is enabled.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the router to a firmware version that removes the SetIpMacBind buffer overflow (check the vendor’s support site for the latest release).
  • If an upgrade is not possible, restrict external access to the web management interface by using firewall rules or network segmentation, or disable remote management entirely.
  • When not feasible to restrict access, monitor incoming traffic for unusually large or malformed SetIpMacBind requests and alert on potential exploitation attempts.

Generated by OpenCVE AI on April 17, 2026 at 21:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Tenda tx3 Firmware
CPEs cpe:2.3:h:tenda:tx3:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:tx3_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda tx3 Firmware
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Tenda
Tenda tx3
Vendors & Products Tenda
Tenda tx3
Type Values Removed Values Added
Description A vulnerability has been found in Tenda TX3 up to 16.03.13.11_multi. This impacts an unknown function of the file /goform/SetIpMacBind. The manipulation of the argument list leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Title Tenda TX3 SetIpMacBind buffer overflow
Weaknesses CWE-119
CWE-120
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Feb 23, 2026, 9:38 AM
Reserved
Feb 6, 2026, 9:00 PM

View source JSON

Updated
Feb 10, 2026, 7:52 PM

JSON

Status
Analyzed
Published
Feb 8, 2026, 6:16 AM
Modified
Jun 17, 2026, 10:30 AM

View source JSON

No data.

Updated
Apr 17, 2026, 10:00 PM

JSON