Tenda AC1206 httpd Stack Buffer Overflow

Overview

CVE-2026-19788 is a stack-based buffer overflow vulnerability residing in the set_device_name function within the httpd web management interface of Tenda AC1206 routers running firmware version 15.03.06.23_multi_TD01. The flaw is triggered through the /goform/SetOnlineDevName endpoint when a specially crafted devName argument is supplied, allowing an attacker to overwrite stack memory, corrupt the return address, and ultimately achieve arbitrary code execution on the device.

Tenda routers occupy a significant share of the SOHO and small enterprise market, particularly across Asia-Pacific regions. The AC1206 model is widely deployed in home office and small business environments, often with the web management interface exposed — either intentionally or due to misconfiguration — to the local network or, in some cases, the public internet. Because the httpd process typically runs with elevated privileges on these embedded Linux platforms, successful exploitation yields full device compromise.

The vulnerability was discovered and publicly disclosed by security researchers, with a proof-of-concept exploit made available in the linked GitHub repository. The public availability of working exploit code significantly raises the practical risk for unpatched devices, as exploitation does not require authentication in many deployment configurations and can be launched from any host with network access to the management interface.

Technical Analysis

The root cause lies in the unchecked use of unsafe string-copy operations inside the set_device_name handler. Embedded firmware written in C for MIPS or ARM targets — as is typical for Tenda devices — frequently relies on functions such as strcpy, sprintf, or sscanf to populate fixed-size stack buffers with user-supplied data. Without bounds enforcement, a sufficiently long input string walks past the buffer boundary, overwriting adjacent stack frames including the saved return address ($ra on MIPS) or link register (LR on ARM).

The vulnerable code pattern in set_device_name follows this general structure:

// Simplified reconstruction of the vulnerable handler logic
// in /goform/SetOnlineDevName (httpd binary, Tenda AC1206 15.03.06.23_multi_TD01)

int set_device_name(struct HttpRequest *req) {
    char devName[64];   // Fixed-size stack buffer
    char *param;

    // Retrieve the devName parameter from the HTTP POST body
    param = websGetVar(req, "devName", "");

    // VULNERABLE: no length check before copying attacker-controlled data
    strcpy(devName, param);  // CWE-121: Stack-based Buffer Overflow

    // Downstream use of devName (e.g., nvram_set, system call)
    nvram_set("device_name", devName);

    websWrite(req, "HTTP/1.1 200 OK\r\n\r\nOK");
    return 0;
}

The websGetVar call returns a raw pointer into the HTTP request body — entirely attacker-controlled, unbounded in length. The strcpy into the 64-byte devName buffer performs no length validation whatsoever. An attacker submitting a devName value exceeding 64 bytes begins overwriting the stack frame: first local variables, then the saved frame pointer, and finally the return address. On MIPS-based Tenda platforms, the saved $ra register is stored at a predictable offset, making reliable control-flow hijacking straightforward, especially in the absence of modern mitigations such as stack canaries, ASLR, or NX enforcement — which are frequently absent or weakly implemented on these embedded targets.

The attack surface is the HTTP POST request to /goform/SetOnlineDevName, making it trivially reachable from any client with network access to the router’s management port (typically TCP 80 or 443).

Impact

An unauthenticated or low-privileged remote attacker can send a crafted HTTP POST request to overwrite the stack and redirect execution to attacker-controlled shellcode or to a ROP chain built from gadgets within the httpd binary or shared libraries present on the device. Given that httpd commonly runs as root on these platforms, a successful exploit delivers a root shell or persistent implant on the device.

Concrete consequences include:

• Full device takeover: An attacker gains root-level control over the router, enabling persistent access and modification of routing tables, DNS settings, firewall rules, and VPN configurations.
• Network pivoting: A compromised router sits inline with all traffic on the local network. Attackers can intercept, inspect, or manipulate unencrypted traffic, redirect DNS queries to malicious resolvers, or use the device as a pivot point into downstream network segments.
• Botnet recruitment: SOHO routers are a primary target for Mirai-derived botnets. A publicly available PoC accelerates large-scale automated exploitation.
• Credential harvesting: By manipulating DNS or serving rogue captive portals, attackers can silently harvest credentials from connected devices.

The CVSS 8.8 (High) score reflects the network-accessible attack vector, low complexity, and high impact across confidentiality, integrity, and availability — with the primary partial mitigation being the adjacency assumption that is often invalidated by internet-facing management interfaces.

How to Fix It

For end users and network administrators:

1. Apply firmware updates immediately. Check the Tenda support portal at https://www.tenda.com.cn/ for updated firmware addressing this CVE. Flash any available update through the router’s administration interface.
2. Disable remote management. If the web management interface is accessible from the WAN interface, disable it immediately. Restrict management access to the LAN segment only.
3. Implement network segmentation. Place the router management VLAN behind an access control list that whitelists only trusted administrator hosts.
4. Consider replacement. If no patch is available for 15.03.06.23_multi_TD01, evaluate replacing the device with a model receiving active security maintenance.

For Tenda firmware developers — the corrected code pattern:

#include <string.h>
#include <stdio.h>

#define DEVNAME_MAX_LEN 64

int set_device_name(struct HttpRequest *req) {
    char devName[DEVNAME_MAX_LEN];
    char *param;
    size_t paramLen;

    param = websGetVar(req, "devName", "");

    // FIXED: validate length before any copy operation
    paramLen = strlen(param);
    if (paramLen == 0 || paramLen >= DEVNAME_MAX_LEN) {
        websWrite(req, "HTTP/1.1 400 Bad Request\r\n\r\nInvalid devName length");
        return -1;
    }

    // FIXED: use length-bounded copy
    strncpy(devName, param, DEVNAME_MAX_LEN - 1);
    devName[DEVNAME_MAX_LEN - 1] = '\0';  // Guarantee null termination

    nvram_set("device_name", devName);

    websWrite(req, "HTTP/1.1 200 OK\r\n\r\nOK");
    return 0;
}

Additionally, firmware build pipelines should enable stack smashing protection (-fstack-protector-strong), position-independent executables (-fPIE -pie), and ensure the kernel is configured with ASLR (/proc/sys/kernel/randomize_va_space = 2). These mitigations do not eliminate the vulnerability but substantially increase exploitation difficulty.

Our Take

This vulnerability is a textbook illustration of why C-based embedded firmware development remains one of the highest-risk software domains in the enterprise attack surface. The pattern — a fixed-size stack buffer populated with unsanitized HTTP input via strcpy — has been the root cause of countless router CVEs for over two decades. It persists not because developers are unaware of strncpy or strlcpy, but because embedded firmware development cycles frequently lack the secure development lifecycle rigor applied to application-layer software: no mandatory code review gates, no compiler hardening flags enforced in the build system, and no SAST integration in CI pipelines.

For enterprises, the lesson is operational: SOHO and prosumer-grade network equipment deployed in branch offices or work-from-home environments represents an underappreciated perimeter. A single exploited router can neutralize substantial investments in endpoint and cloud security. Asset inventory programs must include embedded network devices, and firmware versions must be tracked and patched with the same discipline applied to operating systems and application frameworks.

Detection with SAST

Static analysis detection of stack-based buffer overflows in C firmware code centers on CWE-121 (Stack-based Buffer Overflow) and CWE-20 (Improper Input Validation). Offensive360’s SAST engine flags this vulnerability class through several complementary detection strategies:

• Unsafe function identification: Direct detection of calls to strcpy, strcat, sprintf, gets, scanf, and sscanf where the destination is a stack-allocated buffer. These calls are flagged unconditionally as requiring review when user-controlled data flows into them.
• Taint propagation: The engine traces data flow from HTTP parameter retrieval functions (e.g., websGetVar, httpGetParam, cgi_get_var) through assignment and transformation operations to sink functions that perform unbounded writes. When a taint path reaches a stack buffer write without an intervening length check, the finding is emitted as high-severity.
• Buffer size vs. input source mismatch: Pattern matching on declarations of fixed-size character arrays combined with copy operations whose source is marked as externally controlled and unbounded.
• Missing bounds check detection: Control-flow analysis identifies whether a strlen or equivalent guard precedes the copy operation and whether the result is compared against the declared buffer size before the write proceeds.

In DAST mode, Offensive360 probes web management interfaces of embedded devices by fuzzing form parameters with progressively longer payloads, monitoring for crash indicators (connection reset, HTTP timeout, device reboot) that signal memory corruption — a technique directly applicable to endpoints like /goform/SetOnlineDevName.

References

• https://github.com/lipenghai/iot_bug/blob/main/Tenda/AC12/1.md
• https://vuldb.com/cve/CVE-2026-19788
• https://vuldb.com/submit/868913
• https://vuldb.com/vuln/389755
• https://vuldb.com/vuln/389755/cti
• https://www.tenda.com.cn/