CVE-2026-24103: Tenda AC15 Buffer Overflow Vulnerability

CVE-2026-24103 Overview

CVE-2026-24103 is a buffer overflow vulnerability in the goform/formSetMacFilterCfg handler of the Tenda AC15V1.0 router running firmware version V15.03.05.18_multi. The flaw is classified under CWE-120 (Classic Buffer Copy without Checking Size of Input). An unauthenticated remote attacker can send a crafted HTTP request to the router's web management interface to trigger memory corruption. Successful exploitation can lead to denial of service or arbitrary code execution on the device. The vulnerability is network-reachable, requires no privileges, and requires no user interaction.

Critical Impact
Unauthenticated remote attackers can corrupt memory on affected Tenda AC15 routers, enabling potential code execution and full device compromise.

Affected Products

Tenda AC15 hardware revision 1.0
Tenda AC15 firmware V15.03.05.18_multi
Tenda AC15 router web management interface (goform/formSetMacFilterCfg)

Discovery Timeline

2026-03-03 - CVE-2026-24103 published to NVD
2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-24103

Vulnerability Analysis

The vulnerability resides in the formSetMacFilterCfg function exposed through the router's goform web interface. This endpoint handles MAC address filter configuration requests submitted from the administration panel. The function copies user-supplied parameter data into a fixed-size stack buffer without validating input length. Attackers exploit this by submitting an oversized parameter value in the POST request body. The overflow corrupts adjacent stack memory, including saved return addresses on the MIPS-based device. Because the Tenda AC15 web server runs with root privileges and ships without modern memory protections such as stack canaries or full ASLR, the overflow is directly weaponizable for remote code execution.

Root Cause

The root cause is the absence of bounds checking on attacker-controlled HTTP parameters before they are written into a stack buffer inside formSetMacFilterCfg. The handler relies on strcpy-style copy operations rather than length-limited alternatives, mapping directly to CWE-120.

Attack Vector

Exploitation requires network access to the router's HTTP management interface, which by default listens on the LAN and, in some configurations, on the WAN. An attacker sends a single crafted POST request to /goform/formSetMacFilterCfg containing an overlong field value. No authentication is required because the vulnerable code path is reachable before session validation completes. Refer to the GitHub CVE-2026-24103 Report for the technical writeup and parameter details.

Detection Methods for CVE-2026-24103

Indicators of Compromise

HTTP POST requests to /goform/formSetMacFilterCfg with abnormally long parameter values exceeding typical MAC address or filter name lengths.
Unexpected reboots, web service crashes, or process restarts on the Tenda AC15 device shortly after inbound HTTP traffic.
Outbound connections from the router to unknown hosts, which may indicate post-exploitation command and control.

Detection Strategies

Inspect network traffic to the router's management interface for requests targeting goform/formSetMacFilterCfg with payload sizes inconsistent with legitimate administrative use.
Deploy IDS/IPS signatures that flag oversized POST bodies destined for Tenda goform endpoints.
Correlate router syslog entries showing httpd crashes with concurrent inbound HTTP activity.

Monitoring Recommendations

Forward router logs to a centralized logging or SIEM platform and alert on repeated httpd restarts.
Monitor for any external exposure of the router management interface on TCP/80 or TCP/443 from the WAN.
Track DNS and outbound connection telemetry from the router's IP for anomalous destinations.

How to Mitigate CVE-2026-24103

Immediate Actions Required

Disable remote (WAN-side) web administration on the Tenda AC15 and restrict management access to trusted internal hosts only.
Place affected routers behind a perimeter firewall and block untrusted access to TCP/80 and TCP/443 on the device.
Change administrative credentials and audit the router configuration for unauthorized firewall, DNS, or port-forwarding changes.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2026-24103 at the time of publication. Consult the Tenda Security Overview page for vendor advisories and firmware updates. If a fixed firmware release becomes available for the AC15V1.0, apply it immediately. Where no patch is offered, plan replacement of end-of-life hardware with currently supported equipment.

Workarounds

Segment the router onto a management VLAN and restrict access to the web interface using ACLs.
Disable the MAC filter configuration feature if not required, and avoid using the web UI from untrusted networks.
Replace the affected AC15V1.0 device with a vendor-supported model if no firmware update is forthcoming.

bash

# Example: block external access to the router management interface at an upstream firewall
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP