CVE-2026-2137
Published: 08 February 2026
Summary
CVE-2026-2137 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Tx3 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-2137 is a buffer overflow vulnerability in Tenda TX3 routers running firmware versions up to 16.03.13.11_multi. The flaw affects an unknown function in the /goform/SetIpMacBind file, where manipulation of the argument list triggers the overflow. Published on 2026-02-08, it is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input), earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability enables remote exploitation by an attacker with low privileges over the network. No user interaction is required, and the attack complexity is low. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution via the buffer overflow.
Advisories reference a public proof-of-concept exploit on GitHub, including details and a PoC specific to the Tenda TX3 /goform/SetIpMacBind endpoint. VulDB entries (ctiid.344772, id.344772, submit.747239) document the issue, noting that the exploit has been disclosed to the public and may be used. No patches or specific mitigations are mentioned in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5811
Vulnerability details
A vulnerability has been found in Tenda TX3 up to 16.03.13.11_multi. This impacts an unknown function of the file /goform/SetIpMacBind. The manipulation of the argument list leads to buffer overflow. The attack can be initiated remotely. The exploit has been…
more
disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public web endpoint (/goform/SetIpMacBind) on network device directly enables remote code execution via T1190 Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of argument list inputs to the /goform/SetIpMacBind function to prevent buffer overflows from improper restriction of operations within memory bounds.
Implements memory safeguards such as address space randomization and non-executable memory to mitigate exploitation of buffer overflows even if triggered.
Mandates timely identification, reporting, and patching of flaws like this buffer overflow in router firmware to eliminate the vulnerability.