CVE-2026-2138CWE-119CWE-120

Tenda TX9 SetStaticRouteCfg sub_42D03C buffer overflow

High · published February 8, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
57.0
In the wild
Unconfirmed
What it is

⚡ Watch out, Tenda TX9 users! A remote buffer overflow vulnerability could leave your devices exposed if you’re running versions up to 22.03.02.10_multi! 🔥 Imagine a delivery driver who keeps accepting packages with the wrong addresses, leading to a chaotic mix-up at the distribution center. Similarly, this vulnerability allows attackers to overload the system with unexpected inputs, causing serious disruptions. If exploited, an attacker could gain control and cause mayhem, potentially altering or stealing sensitive data. This isn't just a minor inconvenience; it can lead to complete chaos in your network!

Put simply

Imagine a delivery driver who keeps accepting packages with the wrong addresses, leading to a chaotic mix-up at the distribution center. Similarly, this vulnerability allows attackers to overload the system with unexpected inputs, causing serious disruptions. The vulnerability in the Tenda TX9 arises from a buffer overflow in the SetStaticRouteCfg function. By manipulating the argument list, an attacker can remotely trigger the overflow, leading to unpredictable behaviors or even remote code execution.

What to do

If exploited, an attacker could gain control and cause mayhem, potentially altering or stealing sensitive data. This isn't just a minor inconvenience; it can lead to complete chaos in your network! To secure your devices, immediately update to the latest firmware version that addresses this vulnerability. Ensure your network configurations are reviewed and any unnecessary remote access features are disabled. You've got this! Patch up and take control, and your Tenda device will be safe in no time. 🛡️

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.00826 · 57.0th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2026-02-08T06:02Z
EPSS history
Timeline
  • 08 FEB 06:02Z
    Tenda TX9 SetStaticRouteCfg sub_42D03C buffer overflow
    cvelistv5