High · published November 3, 2025
⚡ A remote attacker can trigger a buffer overflow in Tenda AC10 routers with just a crafty command! Think of it like a delivery driver who receives an order with extra instructions that are so long it spills over into the next package—now that box can burst open and cause chaos! If exploited, this vulnerability could allow an attacker to execute arbitrary commands on the device, potentially gaining control over it. This means they could redirect your internet traffic, spy on your network, or even disable your router entirely—yikes!
Think of it like a delivery driver who receives an order with extra instructions that are so long it spills over into the next package—now that box can burst open and cause chaos! The vulnerability stems from the `formSysRunCmd` function in the `/goform/SysRunCmd` file, where improper handling of the `getui` argument leads to a buffer overflow. This oversight lets remote attackers manipulate memory and execute unauthorized commands.
If exploited, this vulnerability could allow an attacker to execute arbitrary commands on the device, potentially gaining control over it. This means they could redirect your internet traffic, spy on your network, or even disable your router entirely—yikes! To safeguard your network, immediately patch the Tenda AC10 to the fixed version, if available. Additionally, consider changing default credentials and enabling firewall settings to limit access. Regularly check for firmware updates to stay secure! You've got this! Stay proactive and keep your devices secure! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| tenda/ac10_firmware | all versions | — |