Description
Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a permanent Denial of Service (DoS) or potentially execute remote code via the /cgi-bin/UploadCfg endpoint
Published: 2026-07-15
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This flaw is a stack or heap buffer overflow located in the /cgi-bin/UploadCfg endpoint of Tenda AC10 v3 firmware V03.03.16.09. The overflow arises from an unchecked write that corrupts memory, allowing an attacker to execute arbitrary code or cause a permanent denial of service. It is classified as CWE‑120: Vulnerable Buffer Copy without Checking Size or Overrun.

Affected Systems

The vulnerability affects consumer routers manufactured by Tenda, specifically the AC10 v3 model running firmware V03.03.16.09. Firmware upgrades that do not include the patch leave the device exposed; newer releases may resolve the issue, but the information is not currently available.

Risk and Exploitability

The CVSS score of 9.8 indicates critical severity. The EPSS score of < 1% shows a very low probability of exploitation at present, and the flaw is not listed in the CISA KEV catalog. Nevertheless, the attack vector is remote, triggered by an HTTP POST to the UploadCfg path, meaning any network‑connected attacker can attempt the overflow and potentially achieve code execution.

Generated by OpenCVE AI on August 1, 2026 at 09:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the router firmware to the latest version that contains the buffer‑overflow fix.
  • Configure the router to reject or block HTTP POST requests to /cgi-bin/UploadCfg using the device’s firewall or access‑control list.
  • Enable logging for upload attempts and review logs for repeated or suspicious activity to detect exploitation attempts.
  • Apply network segmentation or firewall rules to restrict access to the router or the /cgi-bin/UploadCfg endpoint to trusted hosts only.

Generated by OpenCVE AI on August 1, 2026 at 09:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 01 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
Title Tenda AC10 v3 Buffer Overflow in UploadCfg Endpoint

Tue, 28 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
Title Tenda AC10 v3 Buffer Overflow in UploadCfg Endpoint

Wed, 22 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Title Buffer Overflow in Tenda AC10 v3 /cgi-bin/UploadCfg Enables Remote Code Execution or Permanent Denial of Service

Fri, 17 Jul 2026 06:15:00 +0000

Type Values Removed Values Added
Title Buffer Overflow in Tenda AC10 v3 /cgi-bin/UploadCfg Enables Remote Code Execution or Permanent Denial of Service

Thu, 16 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 16 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Tenda
Tenda ac10
Vendors & Products Tenda
Tenda ac10

Wed, 15 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Description Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a permanent Denial of Service (DoS) or potentially execute remote code via the /cgi-bin/UploadCfg endpoint
References

Subscriptions

Tenda Ac10
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-07-16T15:24:41.397Z

Reserved: 2026-06-07T00:00:00.000Z

Link: CVE-2026-51380

cve-icon Vulnrichment

Updated: 2026-07-16T15:24:34.514Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T09:15:03Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')