CVE-2026-2192
📋 TL;DR
This CVE describes a stack-based buffer overflow vulnerability in Tenda AC9 routers' formGetRebootTimer function. Attackers can exploit this remotely by manipulating sys.schedulereboot.start_time/sys.schedulereboot.end_time parameters to execute arbitrary code. Users of Tenda AC9 routers with vulnerable firmware are affected.
💻 Affected Systems
- Tenda AC9
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistent backdoor installation, and lateral movement to connected networks.
Likely Case
Router compromise allowing traffic interception, DNS hijacking, credential theft, and denial of service.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Public exploit code is available in GitHub repositories. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware for AC9 model. 3. Access router web interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload new firmware file. 6. Wait for automatic reboot.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Network Segmentation
allIsolate router management interface to trusted network
🧯 If You Can't Patch
- Replace affected router with updated model or different vendor
- Implement strict firewall rules blocking all WAN access to router management ports (typically 80/443)
🔍 How to Verify
Check if Vulnerable:
Access router web interface > System Status > Firmware Version. Check if version matches 15.03.06.42_multi.Check Version:
curl -s http://router-ip/goform/GetSysInfo | grep firmware_versionVerify Fix Applied:
After firmware update, verify version no longer shows 15.03.06.42_multi. Test if formGetRebootTimer endpoint still accepts malformed input.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/formGetRebootTimer
- Multiple failed reboot schedule attempts
- Buffer overflow error messages in system logs
Network Indicators:
- Unusual traffic patterns from router to external IPs
- DNS queries to suspicious domains from router
- Port scanning originating from router
SIEM Query:
source="router-logs" AND (uri="/goform/formGetRebootTimer" OR message="*buffer overflow*" OR message="*schedulereboot*")