CVE-2026-104611

Executive Summary

CVE-2026-104611 is a stack-based buffer overflow (CWE-119) in the Tenda AC9 router firmware version 15.03.02.13, reachable through the POST request handler for /goform/fast_setting_internet_set. Manipulation of the netWanType argument allows a remote attacker to overflow a stack buffer, and a public exploit is reported to exist. With a CVSS base score of 9.1 (Critical) and scope change, successful exploitation can yield full compromise of the device with high confidentiality, integrity, and availability impact.

Technical Analysis

The vulnerability resides in the web management surface of the Tenda AC9 running firmware 15.03.02.13. Specifically, it is an "unknown function" within the component identified as the POST Request Handler for the file /goform/fast_setting_internet_set. The flaw is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and manifests as a stack-based buffer overflow when the netWanType argument is manipulated.

At a vulnerability-class level: the endpoint accepts an HTTP POST request whose body includes the netWanType parameter. The handler copies or parses this attacker-controlled value into a fixed-size stack buffer without adequate bounds validation. Because the copy is not length-checked against the destination buffer size, supplying an overlong netWanType value overwrites adjacent stack memory, including saved registers and potentially the return address. This is the canonical stack-based buffer overflow mechanism: unchecked input length → memory corruption → control-flow hijack or crash.

The attack is carried out remotely (AV:N). The CVSS vector indicates PR:H (privileges required: high), meaning the vulnerable handler is presumed to require an authenticated administrative session to reach — a common arrangement on router management interfaces where configuration endpoints are gated behind admin login. However, because the router management interface is frequently exposed for remote administration or reachable from the LAN by compromised hosts, and because the scope is marked as changed (S:C), a compromise of the web handler can impact components beyond the vulnerable application itself — i.e., the underlying firmware/OS.

Notable data constraints: the NVD description does not name the exact function, the buffer length, the copy routine (e.g., strcpy/memcpy/sprintf), or the exact offset. No public PoC or exploit code is bundled with this record, and no Nuclei template is available. The exploit is nonetheless described as "now public," meaning a working proof-of-concept or advisory write-up exists externally even though it is not attached to this dataset. All attack-chain specifics below are therefore described at the vulnerability-class level rather than at a fabricated code level.

Exploitation Scenarios

Important caveat: No public PoC or exploit code is bundled in this dataset. The attack chain is inferred from the vulnerability class (stack-based buffer overflow via an unvalidated POST parameter) and the CVSS vector. No specific function names, buffer sizes, or payload bytes are invented.

1. Reconnaissance / target identification. The attacker identifies exposed Tenda AC9 management interfaces. This is typically done by scanning for the vendor's router management UI (Shodan queries such as product:"Tenda AC9", http.title:"Tenda", or fingerprinting the /goform/ handler namespace). Targets reachable over the WAN with management exposed, or targets on the same LAN segment, are prioritized.

2. Authentication / precondition. Because the CVSS vector specifies PR:H, the attacker is presumed to need an authenticated administrative session (or a pre-existing foothold such as default/weak credentials) to reach the /goform/fast_setting_internet_set handler. If authentication can be bypassed or default credentials are unchanged, the barrier is removed. The vulnerable request is an HTTP POST targeting /goform/fast_setting_internet_set.

3. Triggering the flaw. The attacker sends a crafted POST request whose netWanType argument is supplied with an overlong value. The handler performs an unchecked copy of this value into a fixed-size stack buffer, causing a stack-based buffer overflow (CWE-119). At this stage the attacker can control memory adjacent to the buffer.

4. Payload / execution. Since this is a stack-based overflow, the classic outcome is corruption of saved control data (return address / saved frame pointer), enabling redirection of execution flow. Depending on mitigations present in the firmware (or their absence — common in embedded router images), this can escalate to arbitrary code execution in the context of the web management process, or at minimum a reliable denial-of-service crash. Because the exploit is described as public, a working payload is presumed to exist in the wild, though its specifics are not provided in this dataset.

5. Post-exploitation impact. Given CVSS C:H/I:H/A:H and S:C, a successful exploit can fully compromise the device — exfiltrating configuration and credentials, modifying routing/firewall/WAN settings, installing persistent implants, or using the router as a pivot into the internal network. A DoS condition (device reboot/crash) is also achievable via the same overflow.

Impact Assessment

• CVSS: 9.1 Critical — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
• Attack Vector (AV:N): Exploitable over the network.
• Attack Complexity (AC:L): No special conditions beyond a crafted request; the mechanism is straightforward for a buffer overflow.
• Privileges Required (PR:H): Presumed administrative access to the management handler is needed; this raises the bar relative to a pre-auth flaw but does not neutralize the risk where default/weak credentials or exposed admin interfaces exist.
• Scope (S:C): Impact extends beyond the vulnerable component to the host firmware, elevating severity.
• Confidentiality/Integrity/Availability (C:H/I:H/A:H): Full impact to each.

Blast radius: Tenda AC9 devices on firmware 15.03.02.13. Routers sit at a trust boundary; compromise enables traffic interception, DNS manipulation, credential capture, lateral movement, and supply-chain-style downstream attacks against all clients behind the device. SOHO routers are also frequent targets for botnet recruitment. Given the exploit is public, internet-exposed and LAN-exposed devices alike are at material risk. No CISA KEV listing currently, and no EPSS score has been assigned by FIRST.org.

Detection Guidance

Sigma Rule

title: Tenda AC9 netWanType Stack Buffer Overflow Attempt (CVE-2026-104611)
id: 7f3c1a2e-9b4d-4c6a-a1f0-tenda104611
status: experimental
description: Detects oversized or anomalous netWanType values posted to the Tenda AC9 fast_setting_internet_set handler, indicative of a stack-based buffer overflow attempt.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104611
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-stem|contains: '/goform/fast_setting_internet_set'
  selection_param:
    cs-uri-query|contains: 'netWanType='
  selection_anomaly:
    cs-uri-query|re: 'netWanType=[^&]{64,}'
  condition: selection_endpoint and (selection_param or selection_anomaly)
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate but unusually long WAN type strings (rare)
level: high

YARA Rule

rule CVE_2026_104611_Tenda_AC9_netWanType
{
    meta:
        description = "Detects exploit payloads or requests targeting Tenda AC9 netWanType stack buffer overflow"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104611"
        cve = "CVE-2026-104611"
        date = "2026-01-01"

    strings:
        $endpoint = "/goform/fast_setting_internet_set" ascii nocase
        $param    = "netWanType=" ascii nocase
        $post     = "POST " ascii

    condition:
        uint16(0) == 0x4854 or $endpoint or ($post and $param)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104611 Tenda AC9 netWanType Stack Buffer Overflow Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/goform/fast_setting_internet_set"; http.request_body; content:"netWanType="; pcre:"/netWanType=[^&\r\n]{64,}/Ui"; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-admin; reference:cve,2026-104611; sid:2026104611; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method == "POST" and
     http.request.uri : "/goform/fast_setting_internet_set"]
  [network where http.request.method == "POST" and
     http.request.uri : "/goform/fast_setting_internet_set" and
     http.request.body.text : "netWanType=*"]

Splunk SPL Query

index=web OR index=proxy sourcetype=*access* OR sourcetype=stream:http
| search (uri_path="/goform/fast_setting_internet_set" OR http.url="*goform/fast_setting_internet_set*")
| eval wan=coalesce(form_data, http.request.body, request_body)
| search wan="*netWanType=*"
| rex field=wan "netWanType=(?<netWanVal>[^&]+)"
| eval wan_len=len(netWanVal)
| where wan_len >= 64
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, wan_len
| sort - wan_len

Wazuh OSSEC Rule

<group name="web,tenda,cve-2026-104611,">
  <rule id="104611" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.request.method">POST</field>
    <field name="http.request.uri" type="pcre2">/goform/fast_setting_internet_set</field>
    <regex type="pcre2">netWanType=[^&\s]{64,}</regex>
    <description>CVE-2026-104611: Tenda AC9 netWanType stack buffer overflow attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,exploit_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Disable remote/WAN management of the Tenda AC9 and restrict the web interface to trusted LAN segments only. The primary exposure reducer for a network-reachable handler is removing reachability.
   • Change default administrative credentials and enforce strong, unique admin passwords to satisfy the PR:H precondition and block exploitation by unauthenticated insiders.
   • Block or alert on access to /goform/fast_setting_internet_set from untrusted sources; segment IoT/SOHO devices on isolated VLANs.
   • Where the device is not required as an internet-facing router, replace it with a supported product.
   • Monitor device logs for reboots/crashes (possible DoS manifestation of the same overflow).

2. Patch / upgrade steps

   • No patch or fixed firmware version is available from any tracked source at time of writing (patch confidence 0/4). The affected version is 15.03.02.13.
   • Confirm directly with Tenda for an updated AC9 firmware; do not assume any specific version is fixed until the vendor publishes an advisory. As of this record, no vendor fix or workaround is documented.

3. Long-term hardening

   • Maintain a hardware/firmware asset inventory and lifecycle program; retire end-of-support SOHO routers promptly.
   • Centralize router management access, disable WAN-side admin, and enforce network segmentation and egress filtering.
   • Deploy the detection rules above (Sigma/YARA/Suricata/Elastic/Splunk/Wazuh) to gain coverage for exploitation attempts and anomalous POST payloads.
   • Track CVE-2026-104611 for a vendor advisory and re-evaluate remediation when patch evidence appears; consider CISA/advisory feeds given the public exploit status.

References

• NVD — CVE-2026-104611: https://nvd.nist.gov/vuln/detail/CVE-2026-104611
• CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer): https://cwe.mitre.org/data/definitions/119.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• Tenda official product/support site (verify AC9 firmware advisories directly with the vendor): https://www.tenda.com.cn / https://www.tendacn.com
• CISA Known Exploited Vulnerabilities Catalog (check for future listing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild note: The NVD description states the exploit is "now public." No specific threat-actor campaign attribution is provided in this dataset, and CVE-2026-104611 is not currently listed in CISA KEV. Treat public-exploit status plus the lack of a vendor patch as an elevated, ongoing risk.