CVE-2026-2191: Tenda AC9 Buffer Overflow Vulnerability

CVE-2026-2191 Overview

A stack-based buffer overflow vulnerability has been identified in the Tenda AC9 router running firmware version 15.03.06.42_multi. The vulnerability exists in the formGetDdosDefenceList function, which improperly handles the security.ddos.map argument. When manipulated by an attacker, this input validation failure leads to a classic stack-based buffer overflow condition. The vulnerability can be exploited remotely over the network by authenticated attackers with high privileges, potentially leading to complete device compromise including confidentiality, integrity, and availability impacts.

Critical Impact
Remote exploitation of this stack-based buffer overflow can allow attackers to execute arbitrary code on the affected Tenda AC9 router, potentially gaining full control of the network device and using it as a pivot point for further attacks on the internal network.

Affected Products

Tenda AC9 Firmware version 15.03.06.42_multi
Tenda AC9 Hardware

Discovery Timeline

February 8, 2026 - CVE-2026-2191 published to NVD
February 10, 2026 - Last updated in NVD database

Technical Details for CVE-2026-2191

Vulnerability Analysis

This vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), indicating a fundamental failure in memory boundary management within the affected firmware. The formGetDdosDefenceList function processes DDoS defense configuration data without adequately validating the size of input received through the security.ddos.map parameter.

When an attacker supplies a specially crafted, oversized input to this parameter, the function copies this data to a fixed-size stack buffer without proper bounds checking. This allows the attacker to overwrite adjacent memory on the stack, including critical control flow data such as return addresses and saved frame pointers.

The network-accessible nature of this vulnerability significantly increases its risk profile. While high privileges are required for exploitation, authenticated administrative access to IoT devices like routers is often easier to obtain through default credentials, credential reuse, or other authentication bypass techniques common in embedded device environments.

Root Cause

The root cause of CVE-2026-2191 lies in insufficient input validation and unsafe memory handling practices within the formGetDdosDefenceList function. The firmware fails to verify that the length of data provided via the security.ddos.map argument does not exceed the allocated stack buffer size before performing memory copy operations. This is a common vulnerability pattern in embedded systems and IoT devices where development often prioritizes functionality over security, and where resource constraints may discourage the use of safer memory handling functions.

Attack Vector

The attack can be initiated remotely over the network, making it accessible to any attacker who can reach the router's management interface. The exploitation flow typically follows these steps:

An attacker gains authenticated access to the Tenda AC9 router's web management interface (high privileges required)
The attacker identifies the vulnerable endpoint associated with the formGetDdosDefenceList function
A malicious HTTP request is crafted containing an oversized security.ddos.map parameter value
When processed by the vulnerable function, the oversized input overwrites stack memory
By carefully controlling the overflow data, the attacker can redirect execution flow to injected shellcode or return-oriented programming (ROP) gadgets

The vulnerability has been publicly disclosed with a proof-of-concept available through the GitHub IoT Vulnerability Report. Additional technical details can be found in the VulDB Vulnerability Entry #344894.

Detection Methods for CVE-2026-2191

Indicators of Compromise

Unusual or unexpected HTTP requests to router management endpoints containing abnormally large parameter values in the security.ddos.map field
Router crashes, reboots, or unexpected behavior following administrative interface access
Anomalous network traffic patterns originating from the router indicative of command and control communication
Evidence of unauthorized configuration changes to the DDoS defense settings

Detection Strategies

Implement network intrusion detection rules to identify HTTP requests with oversized parameters targeting Tenda AC9 management interfaces
Monitor router syslog output for crash signatures, segmentation faults, or memory-related error messages
Deploy web application firewall (WAF) rules to block requests with abnormally large input values to router administrative endpoints
Conduct regular firmware integrity checks to detect any unauthorized modifications

Monitoring Recommendations

Enable and centralize logging for all Tenda AC9 router administrative access attempts
Configure alerting for repeated authentication attempts or unusual administrative session patterns
Implement network segmentation to restrict management interface access to trusted networks only
Monitor for any outbound connections from router IP addresses to unknown external hosts

How to Mitigate CVE-2026-2191

Immediate Actions Required

Restrict network access to the Tenda AC9 management interface to trusted IP addresses only using firewall rules
Disable remote management functionality if not operationally required
Change default administrative credentials to strong, unique passwords
Consider network isolation of affected devices until a patch becomes available
Review network logs for any evidence of exploitation attempts

Patch Information

As of the last modification date of this CVE entry (February 10, 2026), no official patch from Tenda has been referenced in the vulnerability data. Organizations should monitor the Tenda Official Website for firmware updates addressing this vulnerability. The VulDB Entry #344894 may also provide updated patch information as it becomes available.

Workarounds

Implement strict network access controls to limit management interface exposure to only authorized administrators from trusted network segments
Deploy a web application firewall (WAF) or reverse proxy in front of the router management interface with rules to block requests containing oversized parameter values
Disable the DDoS defense feature if operationally feasible to reduce the attack surface associated with the vulnerable function
Consider replacing affected devices with alternatives from vendors with stronger security update practices

bash

# Example: Restrict management interface access using iptables on an upstream device
# Allow management access only from trusted admin workstation
iptables -A FORWARD -s 192.168.1.100 -d 192.168.1.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -s 192.168.1.100 -d 192.168.1.1 -p tcp --dport 443 -j ACCEPT
# Block all other management access to the router
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 443 -j DROP