CVE-2026-67822

Tenda W6-S 1.0.0.4510 contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length restriction, leading to stack overflow...

CVE-2026-67822

The Tenda W6-S wireless access point (firmware v1.0.0.4(510) ) is vulnerable to a stack-based buffer overflow in the formwrlSSIDset() function, which handles the /goform/wifiSSIDset endpoint. The root cause is the use of sprintf to copy user-controlled GO and index parameters into a fixed 64-byte...