CVE-2026-51380: Tenda AC10 v3 RCE Vulnerability

CVE-2026-51380 Overview

CVE-2026-51380 is a buffer overflow vulnerability in the Tenda AC10 v3 wireless router running firmware version V03.03.16.09. The flaw resides in the /cgi-bin/UploadCfg endpoint, which handles configuration file uploads. Attackers can send crafted requests to trigger memory corruption in the router's web management service. Successful exploitation results in a permanent Denial of Service (DoS) or potential remote code execution on the affected device.

Critical Impact
Remote attackers can render Tenda AC10 v3 routers permanently unresponsive or execute arbitrary code by sending malformed data to the /cgi-bin/UploadCfg endpoint.

Affected Products

Tenda AC10 v3 router
Firmware version V03.03.16.09
Devices exposing the web management interface (/cgi-bin/UploadCfg)

Discovery Timeline

2026-07-15 - CVE-2026-51380 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-51380

Vulnerability Analysis

The vulnerability is a buffer overflow in the HTTP handler for the /cgi-bin/UploadCfg endpoint of the Tenda AC10 v3 router. This endpoint processes configuration data submitted through the router's web management interface. The handler copies attacker-supplied input into a fixed-size stack or heap buffer without enforcing proper length validation. When an oversized payload is provided, adjacent memory is overwritten, corrupting program state and control flow structures.

The consequences depend on how the overwritten memory is used by the CGI process. In the least severe case, the web service crashes and fails to restart, producing a persistent DoS condition that requires physical intervention to recover. In the worst case, the attacker overwrites saved return addresses or function pointers on the MIPS-based device and redirects execution to shellcode, achieving remote code execution as the process owner — typically root on Tenda consumer routers. The publicly available proof of concept material is hosted on the researcher's GitHub repository.

Root Cause

The root cause is missing bounds checking on request data passed into the UploadCfg handler. The firmware trusts client-supplied length or content fields and copies them into an undersized destination buffer. This is a common defect pattern in embedded router firmware [CWE-120].

Attack Vector

An unauthenticated or authenticated attacker with network reachability to the router's HTTP management interface can trigger the flaw. The attacker sends an HTTP request to /cgi-bin/UploadCfg containing an oversized parameter value. Exposure increases significantly when remote management is enabled on the WAN interface.

No verified exploit code is reproduced here. Refer to the proof of concept archive published by the researcher for technical details.

Detection Methods for CVE-2026-51380

Indicators of Compromise

HTTP POST requests to /cgi-bin/UploadCfg containing unusually large parameter values or malformed multipart data.
Repeated crashes or reboots of the Tenda AC10 v3 web management service (httpd).
Unexplained loss of management interface connectivity while the router still forwards traffic.
Outbound connections from the router to unfamiliar hosts, indicating possible post-exploitation activity.

Detection Strategies

Inspect HTTP traffic destined for router management interfaces for oversized payloads targeting /cgi-bin/UploadCfg.
Deploy network intrusion detection signatures that match anomalous request lengths against Tenda CGI endpoints.
Correlate router availability alerts with preceding HTTP traffic to the management interface.

Monitoring Recommendations

Log all administrative access attempts to the router web UI and forward them to a centralized SIEM.
Monitor for scanning activity targeting TCP 80 and 443 on router-facing network segments.
Alert on repeated connection resets or timeouts from router management IP addresses.

How to Mitigate CVE-2026-51380

Immediate Actions Required

Disable remote management on the WAN interface of all Tenda AC10 v3 routers until a fix is available.
Restrict access to the router web UI to a dedicated management VLAN or trusted host list.
Change default administrative credentials and enforce strong passwords on all devices.
Audit deployed Tenda inventory to identify devices running firmware V03.03.16.09.

Patch Information

No vendor patch is referenced in the NVD entry at time of publication. Check the Tenda product support page for firmware updates addressing this issue. Apply the update as soon as the vendor releases a fixed firmware version.

Workarounds

Block inbound traffic to router management ports at the perimeter firewall or upstream ISP router.
Place the affected device behind a network segment that filters HTTP requests to /cgi-bin/UploadCfg from untrusted sources.
Replace end-of-support Tenda AC10 v3 hardware if the vendor does not issue a firmware fix.

bash

# Example: block external access to router management interface using iptables
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP