go-without-bounds-cve-2026-67822-stack-overflow-in-tenda-w6-s-wifissidset

CVE-2026-67822 — Tenda W6-S wifiSSIDset Stack Buffer Overflow PoC Companion PoC for the Hunt-Benito article "GO Without Bounds: CVE-2026-67822 — Stack Overflow in Tenda W6-S'swifiSSIDset Form Handler". CVE-2026-67822 CVSS 9.8 Critical, CWE-121 is a stack-based buffer overflow in formwrlSSIDset, t...

Exploit for CVE-2026-67822

CVE-2026-67822 — Tenda W6-S wifiSSIDset Stack Buffer Overflo...

CVE-2026-67822

Tenda W6-S 1.0.0.4510 contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length restriction, leading to stack overflow...

CVE-2026-67822

Tenda W6-S 1.0.0.4510 contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length restriction, leading to stack overflow...

PT-2026-66786

Tenda W6-S 1.0.0.4510 contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length restriction, leading to stack overflow...

EUVD-2026-51587

Tenda W6-S 1.0.0.4510 contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length restriction, leading to stack overflow...

CVE-2026-67822

Tenda W6-S 1.0.0.4510 contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length restriction, leading to stack overflow...

CVE-2026-67822

Tenda W6-S 1.0.0.4510 contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length restriction, leading to stack overflow...

CVE-2026-67822: Stack-based Buffer Overflow

Tenda W6-S 1.0.0.4510 contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length restriction, leading to stack overflow...

CVE-2025-15254

A vulnerability was found in Tenda W6-S 1.0.0.4510. This affects the function TendaAte of the file /goform/ate of the component ATE Service. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used...

EUVD-2025-205784

A vulnerability was found in Tenda W6-S 1.0.0.4510. This affects the function TendaAte of the file /goform/ate of the component ATE Service. Performing manipulation results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used...

CVE-2025-15254

A vulnerability was found in Tenda W6-S 1.0.0.4510. This affects the function TendaAte of the file /goform/ate of the component ATE Service. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used...

CVE-2025-15254

A vulnerability was found in Tenda W6-S 1.0.0.4510. This affects the function TendaAte of the file /goform/ate of the component ATE Service. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used...

CVE-2025-15255

Tenda W6-S is affected by CVE-2025-15255. The vulnerability exists in the R7websSsecurityHandler component of /bin/httpd and is triggered by manipulating the Cookie argument, causing a stack-based buffer overflow. The issue can be exploited remotely and a public exploit is available. Affected ver...

CVE-2025-15255 Tenda W6-S R7websSsecurityHandler httpd stack-based overflow

A vulnerability was determined in Tenda W6-S 1.0.0.4510. This impacts an unknown function of the file /bin/httpd of the component R7websSsecurityHandler. Executing a manipulation of the argument Cookie can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has...

CVE-2025-15255 Tenda W6-S R7websSsecurityHandler httpd stack-based overflow

A vulnerability was determined in Tenda W6-S 1.0.0.4510. This impacts an unknown function of the file /bin/httpd of the component R7websSsecurityHandler. Executing a manipulation of the argument Cookie can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has...

EUVD-2025-205819

A vulnerability was determined in Tenda W6-S 1.0.0.4510. This impacts an unknown function of the file /bin/httpd of the component R7websSsecurityHandler. Executing manipulation of the argument Cookie can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has bee...

CVE-2025-15255

A vulnerability was determined in Tenda W6-S 1.0.0.4510. This impacts an unknown function of the file /bin/httpd of the component R7websSsecurityHandler. Executing a manipulation of the argument Cookie can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has...

CVE-2025-15254

CVE-2025-15254 affects Tenda W6-S 1.0.0.4(510) ATE Service, specifically the TendaAte function in the /goform/ate file. The root cause is an input manipulation that enables an OS command injection. The vulnerability can be exploited remotely over the network, and the exploit has been publicly dis...

CVE-2025-15254 Tenda W6-S ATE Service ate TendaAte os command injection

A vulnerability was found in Tenda W6-S 1.0.0.4510. This affects the function TendaAte of the file /goform/ate of the component ATE Service. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used...