CVE-2026-3400
📋 TL;DR
A stack-based buffer overflow vulnerability in Tenda AC15 routers allows remote attackers to execute arbitrary code by manipulating the wpapsk_crypto2_4g parameter in the /goform/TextEditingConversion endpoint. This affects Tenda AC15 routers up to firmware version 15.13.07.13. The vulnerability is remotely exploitable and public exploit code exists.
💻 Affected Systems
- Tenda AC15
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, network infiltration, and persistent backdoor installation.
Likely Case
Remote code execution allowing attackers to reconfigure router settings, intercept network traffic, or launch attacks against internal devices.
If Mitigated
Limited impact if the router is behind a firewall with restricted WAN access or if the vulnerable endpoint is disabled.
🎯 Exploit Status
Exploit code is publicly available and requires no authentication. The vulnerability is in a web form handler accessible via HTTP.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: No
Instructions:
Check Tenda's official website for firmware updates. If available, download the latest firmware and apply via the router's web interface under System Tools > Firmware Upgrade.
🔧 Temporary Workarounds
Disable WAN access to web interface
allPrevent external access to the vulnerable endpoint by disabling remote management.
Access router web interface > Advanced > System Tools > Remote Management > Disable
Block access to vulnerable endpoint
linuxUse firewall rules to block access to /goform/TextEditingConversion
iptables -A INPUT -p tcp --dport 80 -m string --string "/goform/TextEditingConversion" --algo bm -j DROP
🧯 If You Can't Patch
- Replace affected routers with patched or different models
- Isolate routers in a separate VLAN with strict network segmentation
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under System Status > Firmware Version. If version is 15.13.07.13 or lower, device is vulnerable.Check Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is higher than 15.13.07.13 after update. Test if /goform/TextEditingConversion endpoint responds with error or is removed.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /goform/TextEditingConversion with long wpapsk_crypto2_4g parameter
- Unusual process execution or memory errors in router logs
Network Indicators:
- HTTP POST requests to router IP on port 80 with TextEditingConversion in URL
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND url="/goform/TextEditingConversion" AND (param="wpapsk_crypto2_4g" OR data_size>1000)