CVE-2026-1329 Overview
CVE-2026-1329 is a stack-based buffer overflow vulnerability in the Tenda AX1803 wireless router running firmware version 1.0.0.1. The flaw resides in the fromGetWifiGuestBasic function handling requests to the /goform/WifiGuestSet endpoint. Attackers can trigger memory corruption by manipulating the guestWrlPwd, guestEn, guestSsid, hideSsid, or guestSecurity arguments. The vulnerability is exploitable remotely and a public exploit has been disclosed, increasing the risk of opportunistic attacks against exposed devices. The flaw is tracked under CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer.
Critical Impact
Remote attackers with low privileges can corrupt router memory through crafted HTTP requests, leading to denial of service or potential arbitrary code execution on the device.
Affected Products
- Tenda AX1803 router (hardware)
- Tenda AX1803 firmware version 1.0.0.1
- Deployments exposing the /goform/WifiGuestSet management endpoint
Discovery Timeline
- 2026-01-22 - CVE-2026-1329 published to NVD
- 2026-02-03 - Last updated in NVD database
Technical Details for CVE-2026-1329
Vulnerability Analysis
The vulnerability exists in the fromGetWifiGuestBasic function, which processes guest Wi-Fi configuration requests submitted to the /goform/WifiGuestSet handler in the Tenda AX1803 web management interface. The function copies user-controlled parameters into fixed-size stack buffers without enforcing length validation. Submitting an oversized value for guestWrlPwd, guestEn, guestSsid, hideSsid, or guestSecurity overwrites adjacent stack memory, including saved return addresses.
Successful exploitation can crash the httpd process responsible for the web administration interface, producing a denial of service. With reliable control of return-address overwrites, an attacker may redirect execution and run arbitrary code in the context of the router's web server, which typically operates with elevated privileges on consumer-grade firmware.
Root Cause
The root cause is the absence of bounds checking when copying HTTP request parameters into stack-allocated buffers inside fromGetWifiGuestBasic. The handler trusts the length of attacker-supplied input strings, a classic instance of [CWE-119]. No canary or compile-time mitigation reliably blocks the overflow in the affected firmware build.
Attack Vector
The attack is launched over the network against the router's HTTP management interface. An authenticated user with low-privilege credentials can submit a crafted POST request to /goform/WifiGuestSet containing oversized guest-network parameters. Where the web interface is exposed to the WAN or an untrusted LAN segment, the vulnerability is reachable without physical proximity to the device.
No verified proof-of-concept code is available in this advisory dataset. Detailed technical analysis is referenced in the Notion Security Analysis and the VulDB entry #342305.
Detection Methods for CVE-2026-1329
Indicators of Compromise
- HTTP POST requests to /goform/WifiGuestSet containing unusually long values for guestWrlPwd, guestSsid, guestEn, hideSsid, or guestSecurity.
- Repeated httpd process crashes or unexpected reboots on Tenda AX1803 devices.
- Unexplained changes to guest Wi-Fi SSID, password, or security mode configuration.
Detection Strategies
- Inspect HTTP request bodies destined for the router management interface and alert on parameter values exceeding expected lengths (for example, SSIDs longer than 32 bytes).
- Use network IDS/IPS signatures targeting POST requests to /goform/WifiGuestSet with anomalous payload sizes.
- Correlate authentication events to the router admin interface with subsequent service availability anomalies.
Monitoring Recommendations
- Log and review all administrative access to Tenda AX1803 devices, including source IP and user agent.
- Monitor SNMP, syslog, or vendor telemetry for repeated httpd restarts that indicate exploitation attempts.
- Track devices running firmware 1.0.0.1 through an asset inventory and flag any reachable from untrusted networks.
How to Mitigate CVE-2026-1329
Immediate Actions Required
- Disable remote (WAN-side) administration on all Tenda AX1803 routers and restrict the management interface to a trusted management VLAN.
- Rotate router administrative credentials and disable any low-privilege accounts that are not strictly required.
- Disable the guest Wi-Fi feature if it is not in active use to reduce the attack surface of /goform/WifiGuestSet.
Patch Information
No vendor patch has been published in the advisory references at the time of NVD publication. Monitor the Tenda official website for firmware updates superseding version 1.0.0.1. Where a fixed firmware is unavailable, treat affected devices as end-of-support and plan replacement with a supported model.
Workarounds
- Block external access to TCP ports used by the router web interface (typically 80/443) at the perimeter firewall.
- Place the router management interface behind a VPN or jump host accessible only to administrators.
- Segment IoT and consumer networking equipment away from sensitive corporate assets to limit lateral movement if a device is compromised.
# Example: restrict router admin interface to a single management host using upstream ACLs
# (Adapt to your firewall syntax; Tenda AX1803 itself offers limited ACL options.)
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80 -s 10.10.0.5 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80 -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 443 -s 10.10.0.5 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
