CVE-2026-2192 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Stack-based buffer overflow** in Tenda AC9’s `formGetRebootTimer` function. 📌 Attackers can crash device or execute arbitrary code via malformed reboot schedule params. 💥 Remote, high-impact.

Q: Root Cause? (CWE/Flaw)

🔍 **CWE-121**: Improperly bounded buffer. 📦 `sys.schedulereboot.start_time`/`end_time` params not validated → overflow stack buffer. 🧩 Classic buffer overflow flaw.

Q: Who is affected? (Versions/Components)

🔌 **Tenda AC9** firmware **v15.03.06.42_multi**. 📦 Affects `formGetRebootTimer` function. 📌 No other versions listed in data.

Q: What can hackers do? (Privileges/Data)

🔓 **Remote code execution (RCE)**. 🧠 Can gain full control: read/write data, hijack device, pivot to network. 🎯 High privilege escalation potential.

Q: Is exploitation threshold high? (Auth/Config)

🔐 **High privilege required?** No. 🚫 But **authentication needed** (PR:H). 📡 Exploitation requires valid session (e.g., logged-in admin).

Q: Is there a public Exp? (PoC/Wild Exploitation)

💻 **Public exploit exists!** 📚 PoC in GitHub repo: [IoT-Vulnerability/tenda4.md](https://github.com/glkfc/IoT-Vulnerability/blob/main/Tenda/tenda4.md). 🌐 Also reported in VulDB as exploited.

Q: How to self-check? (Features/Scanning)

🔍 **Check firmware version**: Log into router → Admin panel → About. 📌 Look for **v15.03.06.42_multi**. 🧪 Use network scanners (e.g., Nmap) for Tenda AC9 devices.

Q: Is it fixed officially? (Patch/Mitigation)

🛡️ **No official patch mentioned**. 📄 Vendor site (tenda.com.cn) listed but no advisory found in data. ❌ Mitigation not confirmed.

Q: What if no patch? (Workaround)

🛠️ **Workaround**: Disable remote management. 🔒 Change admin password. 🚫 Avoid exposing router to internet. 📊 Monitor logs for unusual reboot attempts.

Q: Is it urgent? (Priority Suggestion)

⚠️ **URGENT!** 🚨 CVSS 9.8 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). 💣 Public exploit + RCE risk. 📈 Patch ASAP or isolate device.

Updated Feb 08, 2026 CVSS 7.2 · High

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Stack-based buffer overflow** in Tenda AC9’s `formGetRebootTimer` function. 📌 Attackers can crash device or execute arbitrary code via malformed reboot schedule params. 💥 Remote, high-impact.

Q2Root Cause? (CWE/Flaw)

🔍 **CWE-121**: Improperly bounded buffer. 📦 `sys.schedulereboot.start_time`/`end_time` params not validated → overflow stack buffer. 🧩 Classic buffer overflow flaw.

Q3Who is affected? (Versions/Components)

🔌 **Tenda AC9** firmware **v15.03.06.42_multi**. 📦 Affects `formGetRebootTimer` function. 📌 No other versions listed in data.

Q4What can hackers do? (Privileges/Data)

🔓 **Remote code execution (RCE)**. 🧠 Can gain full control: read/write data, hijack device, pivot to network. 🎯 High privilege escalation potential.

Q5Is exploitation threshold high? (Auth/Config)

🔐 **High privilege required?** No. 🚫 But **authentication needed** (PR:H). 📡 Exploitation requires valid session (e.g., logged-in admin).

Q6Is there a public Exp? (PoC/Wild Exploitation)

💻 **Public exploit exists!** 📚 PoC in GitHub repo: [IoT-Vulnerability/tenda4.md](https://github.com/glkfc/IoT-Vulnerability/blob/main/Tenda/tenda4.md). 🌐 Also reported in VulDB as exploited.

Q7How to self-check? (Features/Scanning)

🔍 **Check firmware version**: Log into router → Admin panel → About. 📌 Look for **v15.03.06.42_multi**. 🧪 Use network scanners (e.g., Nmap) for Tenda AC9 devices.

Q8Is it fixed officially? (Patch/Mitigation)

🛡️ **No official patch mentioned**. 📄 Vendor site (tenda.com.cn) listed but no advisory found in data. ❌ Mitigation not confirmed.

Q9What if no patch? (Workaround)

🛠️ **Workaround**: Disable remote management. 🔒 Change admin password. 🚫 Avoid exposing router to internet. 📊 Monitor logs for unusual reboot attempts.

Q10Is it urgent? (Priority Suggestion)

⚠️ **URGENT!** 🚨 CVSS 9.8 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). 💣 Public exploit + RCE risk. 📈 Patch ASAP or isolate device.

Continue exploring

Vulnerability detail Full AI analysis (login) Tenda CWE-121