Tenda AC9: Stack-based buffer overflow in fast_setting_internet_set
Summary
A stack-based buffer overflow in the web POST request handler of Tenda AC9 router firmware 15.03.02.13 allows an attacker to affect the device via the netWanType argument of /goform/fast_setting_internet_set. According to the CVE description, an exploit is public, but a public proof-of-concept status is conflicting among sources. Exploitation requires high privileges on the router's web management interface (PR:H), so the risk depends mainly on whether that interface is reachable from untrusted networks and how strong the admin credentials are.
Affected
- Tenda AC9 firmware 15.03.02.13 (the build string appears as 15.03.2.13 and as RouterOS AC9V1.0BR_V15.03.2.13 in some sources)
- Other versions: Unknown.
Fixed in
Unknown. No fixed firmware version or vendor advisory was found.
Workaround
- Disable remote (WAN) access to the web management interface and keep it on the LAN only.
- Change default and weak admin passwords and review admin accounts.
- Place management access behind network segmentation or an admin VLAN.
Exploitation
- Public exploit: The CVE description states the exploit is public and may be used. One aggregator reports no public PoC, so this is unconfirmed.
- Known exploited (CISA KEV): No evidence of active exploitation.
- CISA SSVC: Exploitation none, automatable no, technical impact total.
Our recommendation
- Inventory all Tenda AC9 devices now and identify any with web management reachable from the internet.
- Restrict admin access to the LAN or an admin VLAN and disable WAN management.
- Replace an AC9 that cannot be secured or patched.
- Check the Tenda download page regularly and ask Tenda support whether a fix is planned.
- Monitor the router for unexpected configuration changes or restarts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE entry vuldb.com
- VulDB vulnerability 412918 vuldb.com
- GitHub write-up (ZaneBoden) github.com
- Tenda website www.tenda.com.cn
- Vulners CVE record vulners.com
- PSIRT CVE record psirt.com
- Threatint CVE record cve.threatint.com
- The Hacker Wire www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:34.
Original description (NVD)
A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fast_setting_internet_set of the component POST Request Handler. Performing a manipulation of the argument netWanType results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.