Tenda AC1206 Stack Overflow Vulnerability in fwGetDhcpSetSer CGI (CVE-2026-36789)

Tenda AC1206 Vulnerability Summary Vulnerability Overview Vulnerability Type: Stack Overflow Affected Component: CGI handler Description: A stack overflow vulnerability exists in the function, which is registered via . Within , user-controlled parameters and are retrieved using but undergo no length validation or sanitization. Scope Affected Devices: Tenda AC1206 Affected Firmware Versions: V15.03.06.23 and earlier Remediation Current Status: No specific fix has been provided, but a CVE request has been submitted (CVE-2026-36789). Attack Vector Attack Method: Send a crafted HTTP request to the CGI endpoint, setting the parameter to 188 or longer. Impact Potential Impact: - Denial of Service (Crash/Reboot) - Potential Remote Code Execution (RCE) Timeline 2026-03-10: CVE request submitted to MITRE (7568) 2026-06-06: Public Disclosure - CVE-2026-36789 POC Code ```c __s = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar2 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar3 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar4 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar5 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar6 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar7 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar8 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar9 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar10 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar11 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar12 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar13 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar14 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar15 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar16 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar17 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar18 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar19 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar20 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar21 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar22 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar23 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar24 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar25 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar26 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar27 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar28 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar29 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar30 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar31 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar32 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar33 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar34 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar35 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar36 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar37 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar38 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar39 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar40 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar41 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar42 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar43 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar44 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar45 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar46 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar47 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar48 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar49 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar50 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar51 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar52 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar53 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar54 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar55 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fffff58); pcVar56 = websGetVar(in_stack_fffff50,in_stack_fffff54,in_stack_fff

Goal Reached Thanks to every supporter — we hit 100%!

Tenda AC1206 Stack Overflow Vulnerability in fwGetDhcpSetSer CGI (CVE-2026-36789)

More from this source