Loading story…
Two high-severity vulnerabilities, CVE-2026-4489 and CVE-2026-4490, were disclosed in Tenda A18 Pro firmware version 02.03.02.28, exposing the device to remotely triggered stack-based buffer overflows. The flaws affect the form_fast_setting_wifi_set function in the /goform/fast_setting_wifi_set endpoint and the setSchedWifi function in the /goform/openSchedWifi endpoint, respectively. Both issues are classified under CWE-119 and CWE-121, indicating improper bounds handling in stack memory operations.
The CVE records state that public exploits are available, raising the likelihood of real-world compromise against exposed devices. Both entries were scored as high impact across confidentiality, integrity, and availability in published CVSS v4.0, v3.1, and v2 vectors, indicating that successful exploitation could enable attackers to crash services or potentially execute arbitrary code on vulnerable Tenda A18 Pro systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A separate CVE record for Tenda A18 Pro firmware 02.03.02.28 was received by cna@vuldb.com describing a remotely exploitable stack-based buffer overflow in the setSchedWifi function of the /goform/openSchedWifi endpoint. The record notes that an exploit has been published and may be used, with CWE-119/CWE-121 classifications and high-impact CVSS vectors.
A CVE record for Tenda A18 Pro firmware 02.03.02.28 was received by cna@vuldb.com describing a remotely exploitable stack-based buffer overflow in the form_fast_setting_wifi_set function of the /goform/fast_setting_wifi_set endpoint. The entry states that a public exploit is available and classifies the issue under CWE-119 and CWE-121 with high-impact CVSS scoring.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two router vulnerabilities have been disclosed that expose **D-Link DIR-513** and **Tenda A18 Pro** devices to remotely triggered stack-based buffer overflows. **CVE-2026-4486** affects D-Link DIR-513 version `1.10` in the web service function `formEasySetPassword` at the `/goform/formEasySetPassword` endpoint, where a crafted `curTime` argument can trigger memory corruption. The issue is classified under `CWE-119` and `CWE-121`, and the affected D-Link product is no longer supported by the vendor. A separate flaw, **CVE-2026-4491**, impacts **Tenda A18 Pro** firmware `02.03.02.28` in the `fromSetIpMacBind` function exposed through `/goform/SetIpMacBind`. The vulnerability can be exploited remotely with low attack complexity and low privileges by manipulating request arguments, resulting in a stack-based overflow. Both CVEs were reported as **publicly exploitable**, with references indicating proof-of-concept or exploit details are already available, increasing the risk to internet-exposed and unpatched devices.
Jun 29, 2026
Two high-severity vulnerabilities have been disclosed in **Tenda AC15** router firmware, both involving stack-based buffer overflows in web management handlers that are reachable through crafted POST requests. **CVE-2026-4975** affects firmware version `15.03.05.19` in the `formSetCfm` function behind the `/goform/setcfm` endpoint, where manipulation of the `funcpara1` parameter can corrupt memory and potentially allow remote compromise of the device. A second flaw, **CVE-2026-5830**, affects Tenda AC15 version `15.03.05.18` in the `websGetVar` function used by `/goform/SysToolChangePwd`; crafted `oldPwd`, `newPwd`, or `cfmPwd` values can trigger another stack-based overflow. Both issues are classified under **`CWE-119`** and **`CWE-121`**, carry high-impact severity ratings for confidentiality, integrity, and availability, and have been publicly disclosed, with the latter report explicitly noting that a public exploit is available.
Jun 29, 2026
Two high-severity vulnerabilities have been disclosed in Tenda routers, both enabling remote stack-based buffer overflows through exposed `/goform/` endpoints. **CVE-2026-4551** affects the Tenda **F453** running version `1.0.0.3`, where the `fromSafeClientFilter` function in the `/goform/SafeClientFilter` handler can be exploited by manipulating the `menufacturer/Go` argument. **CVE-2026-5990** affects the Tenda **F451** running version `1.0.0.7`, where the `fromSafeEmailFilter` function in the `/goform/SafeEmailFilter` component can be triggered via the `page` argument. Both flaws are classified under **CWE-119** and **CWE-121** and are described as remotely exploitable with **public exploit information available**, raising the risk of active abuse against exposed devices. The CVE records assign high impact across **confidentiality, integrity, and availability** in published CVSS scoring, indicating that successful exploitation could give attackers a powerful path to compromise vulnerable edge networking equipment.
Jun 29, 2026