CVE-2026-36789
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
In the Tenda AC1206 router with firmware version v15.03.06.23, multiple stack overflows exist in the fromGstDhcpSetSer function via the username and password parameters. These vulnerabilities allow an attacker to cause a Denial of Service (DoS) via a crafted HTTP request.
Risk Assessment
An attacker can remotely crash the router, leading to loss of internet access and other network services for all users.
Recommendation
Contact Tenda for a firmware update that fixes these vulnerabilities, and consider restricting access to the router's management interface.
Other vulnerabilities in Tenda AC1206
See all- CVE-2026-19789High
A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. The function set_wl_guest_iplist in /goform/WifiGuestSet of the httpd web management interface is affected. Manipulating the argument shareSpeed causes stack-based buffer overflow. Remote exploitation is possible, and the exploit has been publicly disclosed.
- CVE-2026-19788High
A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. The function set_device_name in /goform/SetOnlineDevName of the httpd web management interface is affected. Manipulating the argument devName results in stack-based buffer overflow. The attack may be launched remotely, and the exploit has been made public.
Original NVD description (English source)
Shenzhen Tenda Technology Co., Ltd Tenda AC1206 v15.03.06.23 was discovered to contain multiple stack overflows in the fromGstDhcpSetSer function via the username and password parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request.