CVE-2026-16248

Name of the Vulnerable Software and Affected Versions Tenda AC10 version 16.03.10.09 multi TDE01

Description A stack-based buffer overflow exists in the fromAdvSetLanip() function within the /goform/AdvSetLanip endpoint of the httpd/netctrl component. This issue occurs when the GetValue or SetValue arguments are manipulated, potentially allowing a remote attacker to execute arbitrary code, corrupt memory, or cause a denial of service (DoS), which is a condition where the system becomes unavailable to users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /goform/AdvSetLanip endpoint to minimize the risk of exploitation.