CVE-2026-36789 Overview
CVE-2026-36789 is a stack overflow vulnerability affecting Shenzhen Tenda Technology Co., Ltd Tenda AC1206 routers running firmware version v15.03.06.23. The flaw resides in the fromGstDhcpSetSer function, which fails to validate the length of the username and password parameters received through HTTP requests. A remote unauthenticated attacker can send a crafted HTTP request to trigger the overflow and cause a Denial of Service (DoS) condition on the device.
Critical Impact
Remote unauthenticated attackers can crash the router by sending a single crafted HTTP request targeting the DHCP server configuration handler, disrupting network connectivity for all downstream clients.
Affected Products
- Shenzhen Tenda Technology Co., Ltd Tenda AC1206
- Firmware version v15.03.06.23
- The vulnerable fromGstDhcpSetSer handler function
Discovery Timeline
- 2026-06-08 - CVE-2026-36789 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-36789
Vulnerability Analysis
The vulnerability is classified as a stack-based buffer overflow [CWE-121] in the fromGstDhcpSetSer function of the Tenda AC1206 web management interface. This function handles HTTP requests that configure the guest network DHCP server. When processing the username and password parameters, the function copies attacker-supplied data into fixed-size stack buffers without performing length validation.
Supplying parameter values longer than the destination buffers overwrites adjacent stack memory, including saved return addresses. The result is a corrupted execution context that causes the HTTP daemon to crash. Because the router uses a single process to serve management and network control functions, the crash interrupts router operation and degrades network availability.
Root Cause
The root cause is the absence of bounds checking on the username and password request parameters before they are copied into local stack buffers. The function relies on unsafe string-handling routines rather than length-limited copies. This pattern is common across the Tenda AC-series firmware and has produced multiple similar CVEs in handlers exposed by the embedded httpd binary.
Attack Vector
Exploitation requires only network access to the router's HTTP management interface. The attacker submits a crafted HTTP POST request to the endpoint backed by fromGstDhcpSetSer, embedding oversized username and/or password values. No authentication or user interaction is needed. The overflow corrupts the stack frame, triggering an immediate denial of service. A proof-of-concept and request structure are published in the GitHub PoC Repository.
Detection Methods for CVE-2026-36789
Indicators of Compromise
- Unexpected reboots or httpd process crashes on Tenda AC1206 devices running firmware v15.03.06.23.
- HTTP POST requests directed at the guest DHCP configuration endpoint containing abnormally long username or password field values.
- Loss of management interface availability following inbound HTTP traffic from untrusted source IPs.
Detection Strategies
- Inspect HTTP request bodies destined for the router management interface for username or password parameters exceeding expected length thresholds (for example, greater than 128 bytes).
- Correlate router availability loss with preceding HTTP traffic to the LAN-side or WAN-side management port.
- Apply IDS/IPS signatures that flag oversized parameter values targeting fromGstDhcpSetSer and related Tenda DHCP handlers.
Monitoring Recommendations
- Centralize syslog from network devices and alert on repeated httpd restarts or watchdog-triggered reboots.
- Monitor management plane reachability with periodic synthetic probes to detect DoS conditions quickly.
- Track HTTP traffic to embedded device management interfaces from non-administrative source networks.
How to Mitigate CVE-2026-36789
Immediate Actions Required
- Restrict access to the router's HTTP management interface to trusted administrative networks only and block management access from the WAN.
- Disable the guest network DHCP configuration feature if it is not in use to reduce reachable attack surface.
- Place vulnerable Tenda AC1206 devices behind a network segment that filters HTTP requests with oversized parameter values.
Patch Information
No vendor patch has been published in the NVD entry for CVE-2026-36789 at the time of publication. Organizations operating Tenda AC1206 devices on firmware v15.03.06.23 should monitor the Tenda support site for firmware updates and consider replacing the device if a fix is not released. Additional technical details are available in the GitHub PoC Repository.
Workarounds
- Disable remote management on the WAN interface and require VPN access for administrative tasks.
- Apply firewall ACLs to permit HTTP management traffic only from specific administrator hosts.
- Implement an upstream web application firewall or reverse proxy that enforces strict length limits on HTTP form parameters reaching the device.
# Example iptables rules limiting management access to a trusted admin host
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
