CRITICAL🇵🇱 Wersja polska

CVE-2026-24103

CVSS 9.8v3.1pub. 2026-03-03upd. 2026-03-05

A buffer overflow vulnerability was discovered in goform/formSetMacFilterCfg in Tenda AC15V1.0 V15.03.05.18_multi.

🤖 AI Analysis
How it works

The vulnerability (CWE-120 — classic buffer overflow) occurs in the goform/formSetMacFilterCfg function, which is responsible for MAC address filtering configuration. An attacker can provide specially crafted input data that exceeds the size of the allocated buffer in memory. This results in overwriting adjacent memory areas, which can lead to arbitrary code execution.

Impact

An unauthenticated attacker, acting remotely over the network, can take full control of the device, access confidential data, modify its configuration, or permanently disable the router.

Mitigation & patch

Security patches available from the manufacturer should be applied according to the references. It is recommended to monitor the official Tenda website at the address indicated in the references. Until a fix is released, it is recommended to restrict access to the device's administrative panel only to trusted hosts and isolate the device from untrusted networks.

Who is affected

Tenda AC15V1.0 with firmware version V15.03.05.18_multi

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Tenda Ac15

    HW
    Tenda
    1.0

  • Tenda Ac15 Firmware

    OS
    Tenda
    15.03.05.18_multi
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Memory
CWE
References

Related vulnerabilities

CVE-2020-10987CRITICAL9.8⚠ KEVPL ✓same product

Command injection w Tenda AC15 – zdalne wykonanie poleceń systemowych

CVE-2026-24101CRITICAL9.8PL ✓same product

Command injection w Tenda AC15 — brak walidacji parametru formSetIptv

CVE-2026-24105CRITICAL9.8PL ✓same product

Command injection w Tenda AC15 — brak walidacji parametru w formsetUsbUnload

CVE-2025-63666CRITICAL9.8PL ✓same product

Tenda AC15: słaby mechanizm cookie sesji ujawniający hash hasła

CVE-2025-29462CRITICAL9.8PL ✓same product

Buffer overflow w Tenda AC15 — przepełnienie stosu przez HTTP