Tenda AC10 Buffer Overflow Vulnerability (CVE-2026-16248)

A critical stack-based buffer overflow vulnerability, identified as CVE-2026-16248, affects the Tenda AC10 router firmware version 16.03.10.09_multi_TDE01. This flaw is located within the fromAdvSetLanip function of the /goform/AdvSetLanip file, part of the httpd/netctrl component. Attackers can remotely exploit this vulnerability by manipulating the GetValue/SetValue arguments, which can lead to arbitrary code execution and full control over the device. The exploit code for this vulnerability has been publicly released, increasing the risk of widespread exploitation. This poses a significant threat to organizations and individuals using the affected Tenda AC10 routers, as compromised devices can be used for unauthorized network access, data exfiltration, or further attacks on internal systems.

Attack Chain

1. An attacker identifies a vulnerable Tenda AC10 router exposed to the internet.
2. The attacker crafts a specially designed HTTP request targeting the /goform/AdvSetLanip endpoint on the router's web interface.
3. The malicious HTTP request includes crafted GetValue or SetValue arguments designed to exceed the buffer limits.
4. The fromAdvSetLanip function processes the malformed arguments, leading to a stack-based buffer overflow.
5. The buffer overflow overwrites critical memory regions, allowing the attacker to inject and execute arbitrary code on the router.
6. Upon successful code execution, the attacker gains full control over the Tenda AC10 router.
7. The compromised router can then be used as a pivot point for further attacks on the internal network, to monitor or intercept traffic, or to alter device configurations.

Impact

Successful exploitation of CVE-2026-16248 grants attackers complete control over the affected Tenda AC10 router. This can lead to severe consequences including, but not limited to, unauthorized access to the network connected to the router, interception or manipulation of network traffic, and potential for data exfiltration. Attackers could also reconfigure the router to redirect users to malicious websites, launch denial-of-service attacks, or establish persistent backdoors. The public availability of exploit code significantly increases the likelihood of widespread attacks against unpatched devices, posing a critical risk to any organizations or home users utilizing this specific router model.

Recommendation

• Immediately update Tenda AC10 router firmware to the latest secure version once released by the vendor to patch CVE-2026-16248.
• Monitor webserver logs for the /goform/AdvSetLanip endpoint for unusually long or malformed GetValue or SetValue parameters as described in the Overview section.
• Review network firewall rules to restrict access to router administration interfaces from untrusted external networks.