AC12 (15.03.06.23_multi_TD01) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ac12-15.03.06.23_multi_td01/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 14 Aug 2026 12:07:56 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRemote Buffer Overflow in Tenda AC12 Web Management Interfacehttps://feed.craftedsignal.io/briefs/2026-08-tenda-ac12-overflow/Fri, 14 Aug 2026 12:07:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-tenda-ac12-overflow/Tenda AC12 router firmware contains a buffer overflow vulnerability in the httpd web management interface, allowing remote attackers to trigger arbitrary code execution via a manipulated reboot parameter.A remote buffer overflow vulnerability (CVE-2026-19821) exists in the Tenda AC12 router running firmware version 15.03.06.23_multi_TD01. The vulnerability originates within the 'formSetRebootTimer' function of the '/goform/SetSysAutoRebbotCfg' file, which is part of the device's httpd web management interface. By sending a maliciously crafted 'rebootTime' argument, an authenticated remote attacker can cause a buffer overflow, potentially leading to arbitrary code execution or device instability. The vulnerability has been publicly disclosed with functional exploit code available, posing a significant risk to devices accessible over the network. Defenders should prioritize restricting access to the management interface and monitoring for anomalous HTTP requests targeting the reboot configuration endpoint.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the web management service. This can lead to a full device compromise, enabling attackers to gain persistence, intercept network traffic, or use the router as a pivot point for further lateral movement within the local network. Given the router's role as a network gateway, this represents a critical threat to the security and integrity of connected residential or small-office environments.

Recommendation

  • Implement network-level segmentation to restrict access to the Tenda AC12 web management interface to trusted administrative IPs only.
  • Deploy detection rules to monitor web server logs for anomalous POST requests to the /goform/SetSysAutoRebbotCfg endpoint.
  • Disable remote web management access on the router immediately if not required.
  • Check for and apply firmware updates from the vendor if they become available to address CVE-2026-19821.
]]>highadvisory