Critical Stack Overflow in Tenda W6-S wifiSSIDset Endpoint

CVE-2026-67822 is a critical stack-based buffer overflow vulnerability affecting Tenda W6-S wireless access points running firmware version v1.0.0.4(510). The vulnerability resides in the form handler formwrlSSIDset() within the device's GoAhead-derived /bin/httpd web server. An attacker can trigger the overflow by sending a crafted HTTP POST request to the /goform/wifiSSIDset endpoint. Specifically, the GO and index parameters are copied into a fixed 64-byte stack buffer using an unchecked sprintf operation, allowing for memory corruption.

Proof-of-concept exploits are publicly available, demonstrating confirmed denial of service (system crash) and providing a skeleton for potential remote code execution. Because the affected firmware lacks modern exploit mitigations like stack canaries and ASLR on the MIPS architecture, this flaw poses a high risk to unpatched devices.

Attack Chain

1. The attacker performs reconnaissance to identify Tenda W6-S devices reachable over the network.
2. The attacker crafts an HTTP POST request targeting the /goform/wifiSSIDset endpoint.
3. The GO parameter is populated with a payload significantly exceeding 64 bytes to overflow the target buffer.
4. The web server process (/bin/httpd) receives the malicious input through the standard HTTP request body.
5. The sprintf function writes the oversized payload into the fixed 64-byte stack buffer, overwriting adjacent memory, including the saved return address ($ra).
6. The function returns control to the address specified by the attacker (the corrupted $ra).
7. If used for DoS, the process crashes and the web management interface stops responding until the device is power-cycled.
8. If used for RCE, the attacker directs execution flow to shellcode or a ROP chain to achieve arbitrary code execution.

Impact

The vulnerability is rated CVSS 9.8, indicating full impact on confidentiality, integrity, and availability. Successful exploitation typically results in a denial of service, rendering the W6-S wireless access point management interface unreachable. In targeted scenarios, the lack of stack protection on the device firmware allows for potential remote code execution, granting an attacker full control over the wireless access point and a foothold in the local network segment.

Recommendation

Prioritize patching or isolating affected Tenda W6-S devices until a vendor-supplied update is verified.

• Block inbound traffic to the management interface of Tenda W6-S devices on the network perimeter.
• Deploy the Sigma rule below to monitor for large, malformed POST requests to the /goform/wifiSSIDset endpoint, which are indicative of exploitation attempts.
• If firmware updates are unavailable, disable remote management capabilities and restrict access to the management web server to a dedicated, isolated VLAN.