CVE-2026-2191CWE-119CWE-121

Tenda AC9 formGetDdosDefenceList stack-based overflow

High 路 published February 8, 2026

CVSS v4.0
8.6
EPSS
1%
Percentile
55.1
In the wild
Unconfirmed
What it is

馃毃 A remote attack can trigger a stack-based buffer overflow in Tenda AC9, and it's all thanks to a sneaky manipulation of the security.ddos.map argument! 馃敟 Think of this vulnerability like a crowded stadium where a minor flaw in the ticketing system lets unauthorized guests slip in and take control of the sound system鈥攖he chaos could disrupt the entire event! If exploited, an attacker could gain unauthorized access, leading to potential data exposure or even a complete system takeover. This could result in a loss of service and trust that is absolutely devastating for users and organizations alike!

Put simply

Think of this vulnerability like a crowded stadium where a minor flaw in the ticketing system lets unauthorized guests slip in and take control of the sound system鈥攖he chaos could disrupt the entire event! This vulnerability in Tenda AC9's formGetDdosDefenceList function allows attackers to exploit the security.ddos.map argument, resulting in a stack-based buffer overflow that could compromise the device's stability and security.

What to do

If exploited, an attacker could gain unauthorized access, leading to potential data exposure or even a complete system takeover. This could result in a loss of service and trust that is absolutely devastating for users and organizations alike! Update your Tenda AC9 to the latest firmware version immediately to patch this vulnerability. If possible, review your network configurations and restrict remote access to the device to minimize risks. Don't forget to monitor your systems for any suspicious activity! You can tackle this! Follow the steps and secure your network鈥攜our security hero status is activated! 馃Ω

The record
Technical detail
CVSS v4.0
8.6 路 HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.00769 路 55.1th percentile
Weaknesses
CWE-119 路 Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-121 路 Stack-based Buffer Overflow
Published
2026-02-08T22:32Z
EPSS history
Timeline
  • 08 FEB 22:32Z
    Tenda AC9 formGetDdosDefenceList stack-based overflow
    cvelistv5