CVE-2026-104611

EUVD-2026-91579
A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fast_setting_internet_set of the component POST Request Handler. Performing a manipulation of the argument netWanType results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/ZaneBoden/CVEs/blob/main/Tenda-AC9-fast_setting_internet_set.md
https://vuldb.com/cve/CVE-2026-104611
https://vuldb.com/submit/962720
https://vuldb.com/vuln/412918
https://vuldb.com/vuln/412918/cti
https://www.tenda.com.cn/