CVE-2026-36789: Tenda AC1206 Stack Overflow DoS Vulnerability

Technical summary

Multiple stack overflow vulnerabilities exist in the fromGstDhcpSetSer function within Tenda AC1206 v15.03.06.23 firmware. The vulnerability stems from improper input validation on the username and password parameters passed to the DHCP configuration handler. Stack overflows occur when untrusted user input exceeds the bounds of stack-allocated buffers, allowing an attacker to overwrite the return address or other critical stack structures. The attack is delivered via HTTP, making it remotely exploitable from the network without requiring prior authentication or user interaction, leading to process crash and denial of service.

Business impact

Affected routers become unavailable following a denial-of-service attack, interrupting network connectivity for users and devices relying on that access point. In organizational environments, this could disrupt branch office operations, guest networks, or department-level connectivity depending on the deployment model. The need to physically restart the router to restore service increases mean time to recovery and creates operational friction. While no data breach occurs, the availability impact affects business continuity and could cascade to services dependent on that network segment.

Affected systems

Tenda AC1206 devices running firmware version 15.03.06.23 are confirmed vulnerable. This includes both retail and OEM variants of the AC1206 model distributed globally. Organizations should verify their installed firmware version via the device's web administration interface or physical label. Devices running different firmware versions may also be affected; verification against vendor advisories is recommended to determine the full scope of impacted builds.

Exploitability

The vulnerability is highly exploitable. Attack requirements are minimal: an attacker needs only network-level access to the router (typically available on the same LAN segment or potentially from the internet if the HTTP administration interface is exposed) and the ability to craft a malformed HTTP request. No authentication, user interaction, or client-side action is required. Exploitation is straightforward—a single HTTP POST or GET request with oversized or specially formatted username/password parameters can trigger the stack overflow and crash the device. Public proof-of-concept code does not appear to be widely available, but the attack surface is simple enough that exploitation tools could emerge quickly.

Remediation

Contact Tenda support or visit their firmware download portal to identify and deploy a patched firmware version for the AC1206. Verify the version number after upgrade to confirm the patch has been applied. If a firmware update is not available or your device is end-of-life, consider isolating the router's administration interface from untrusted networks and disabling remote management features if not required for operations. Monitor for unexpected router reboots, which may indicate exploitation attempts.

Patch guidance

Verify the current firmware version on your Tenda AC1206 via the web administration panel (typically accessed at 192.168.0.1 or similar). Document the version number and check the Tenda support website or your regional distributor for available firmware releases newer than v15.03.06.23. Download the firmware from official Tenda channels only. Follow Tenda's documented upgrade procedure—typically this involves uploading the firmware binary through the web interface and allowing the device to reboot. Do not interrupt the upgrade process. After the device reboots, verify the new firmware version and test connectivity. If the device is part of a larger deployment, prioritize upgrades for production access points and implement a phased rollout to minimize disruption.

Detection guidance

Monitor network traffic to the router's HTTP administration port (typically 80 or 8080) for unusual request patterns, particularly POST/GET requests with abnormally long or binary-heavy username or password parameters. Look for router syslog or console messages indicating segmentation faults or unexpected restarts. In managed environments, enable SNMP or syslog collection from the router if available and watch for sudden connection drops followed by reboot events. Intrusion detection systems with updated signatures may flag malformed DHCP configuration requests. Baseline the router's expected reboot schedule—unscheduled or frequent restarts warrant investigation.

Why prioritize this

This vulnerability merits medium-to-high priority remediation because it affects network availability, is remotely exploitable without authentication, and targets a commonly deployed consumer-grade device often found in office and branch networks. The CVSS 7.5 (HIGH) score reflects the ease of exploitation and impact on confidentiality. While the attack does not compromise data confidentiality or integrity, the denial-of-service impact justifies prompt patching, especially for routers in critical network roles. If your organization uses Tenda AC1206 devices, begin inventory and testing immediately. If you do not use this model, verify your router inventory to exclude it from scope.

Risk score, explained

The CVSS v3.1 score of 7.5 (HIGH) reflects network-accessible exploitability (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and no user interaction (UI:N). The vector shows impact only to availability (A:H), with no confidentiality or integrity impact. This scoring appropriately elevates a denial-of-service vulnerability because of its remote, unauthenticated nature and the minimal effort required to trigger it. Organizations should not mistake the absence of confidentiality impact for low risk; network availability is a critical security attribute.

Frequently asked questions