CVE-2026-2187: Tenda RX3 Buffer Overflow Vulnerability

CVE-2026-2187 Overview

CVE-2026-2187 is a stack-based buffer overflow vulnerability in the Tenda RX3 router running firmware version 16.03.13.11. The flaw resides in the set_qosMib_list function of the /goform/formSetQosBand endpoint. An attacker can manipulate the list argument to overflow a fixed-size stack buffer. The attack is network-reachable and requires low privileges, making it suitable for remote exploitation against exposed router management interfaces. Public disclosure of the issue includes proof-of-concept material referenced through VulDB and a GitHub issue, increasing the likelihood of opportunistic targeting against Tenda RX3 devices in home and small office environments.

Critical Impact
Remote attackers can corrupt the stack of the router's web management process, enabling potential arbitrary code execution or denial of service against the device.

Affected Products

Tenda RX3 router (hardware)
Tenda RX3 firmware version 16.03.13.11
Deployments exposing /goform/formSetQosBand to untrusted networks

Discovery Timeline

2026-02-08 - CVE-2026-2187 published to NVD
2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-2187

Vulnerability Analysis

The vulnerability is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). It affects the set_qosMib_list function handling requests sent to the /goform/formSetQosBand HTTP endpoint of the Tenda RX3 web management interface. When the function processes the list request parameter, it copies attacker-controlled data into a fixed-size stack buffer without enforcing length validation. A sufficiently long list value overflows the buffer and overwrites adjacent stack memory, including saved return addresses on the MIPS-based firmware typical of Tenda devices.

Successful exploitation can crash the httpd process and disrupt router operations. On embedded Linux routers lacking modern exploit mitigations such as full ASLR or stack canaries, control of the return address can be converted into arbitrary code execution within the web server context.

Root Cause

The root cause is the absence of bounds checking when the set_qosMib_list handler copies the user-supplied list parameter into a local stack buffer. The function relies on unsafe string operations rather than length-bounded copy routines, leaving the buffer length determined entirely by attacker input.

Attack Vector

Exploitation requires the attacker to reach the router's HTTP management interface and submit a crafted POST request to /goform/formSetQosBand containing an oversized list parameter. The attack vector is Network, attack complexity is Low, and exploitation needs low-level privileges on the management interface. No user interaction is required.

The vulnerability is described in public sources without verified exploit code in the provided dataset. See the GitHub Issue Discussion and VulDB Entry #344890 for additional technical context.

Detection Methods for CVE-2026-2187

Indicators of Compromise

HTTP POST requests to /goform/formSetQosBand containing unusually long list parameter values
Repeated crashes or unexpected restarts of the router's httpd web management process
Configuration changes to QoS bands that were not initiated by an administrator
Outbound connections from the router to unfamiliar hosts following management interface access

Detection Strategies

Inspect web access logs on the router or upstream proxies for requests targeting /goform/formSetQosBand with parameter lengths exceeding normal bounds
Monitor network traffic for direct access to the router management interface from the WAN side or from unmanaged client devices
Compare baseline router firmware behavior against runtime anomalies such as repeated service restarts

Monitoring Recommendations

Forward router syslog and HTTP access events to a centralized logging platform for correlation
Alert on any administrative access to the Tenda RX3 web interface from outside the trusted management subnet
Track firmware version inventory to identify devices running 16.03.13.11 until a fixed release is available

How to Mitigate CVE-2026-2187

Immediate Actions Required

Restrict access to the Tenda RX3 web management interface to a dedicated management VLAN or trusted hosts
Disable remote (WAN-side) administration of the router until a vendor patch is applied
Change default and weak administrative credentials to reduce abuse of the low-privilege precondition
Inventory affected Tenda RX3 devices running firmware 16.03.13.11 and prioritize them for replacement or upgrade

Patch Information

At the time of publication, no fixed firmware version is referenced in the available advisories. Monitor the Tenda Official Website and the VulDB CTI Reference #344890 for updates. Apply any vendor-issued firmware update for the RX3 platform as soon as it becomes available.

Workarounds

Place the router behind an upstream firewall that blocks unsolicited inbound HTTP/HTTPS traffic to the management interface
Use network segmentation to isolate the router management plane from general user devices and IoT segments
Where supported, disable the QoS feature path exposed by /goform/formSetQosBand if not required

bash

# Example iptables rule to restrict router admin access to a single management host
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP