Cyber Posture

CVE-2026-2137

HighPublic PoC

Published: 08 February 2026

Published
08 February 2026
Modified
11 February 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0004 11.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2137 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Tx3 Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires validation of argument list inputs to the /goform/SetIpMacBind function to prevent buffer overflows from improper restriction of operations within memory bounds.

prevent

Implements memory safeguards such as address space randomization and non-executable memory to mitigate exploitation of buffer overflows even if triggered.

prevent

Mandates timely identification, reporting, and patching of flaws like this buffer overflow in router firmware to eliminate the vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Buffer overflow in public web endpoint (/goform/SetIpMacBind) on network device directly enables remote code execution via T1190 Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability has been found in Tenda TX3 up to 16.03.13.11_multi. This impacts an unknown function of the file /goform/SetIpMacBind. The manipulation of the argument list leads to buffer overflow. The attack can be initiated remotely. The exploit has been…

more

disclosed to the public and may be used.

Deeper analysisAI

CVE-2026-2137 is a buffer overflow vulnerability in Tenda TX3 routers running firmware versions up to 16.03.13.11_multi. The flaw affects an unknown function in the /goform/SetIpMacBind file, where manipulation of the argument list triggers the overflow. Published on 2026-02-08, it is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input), earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

The vulnerability enables remote exploitation by an attacker with low privileges over the network. No user interaction is required, and the attack complexity is low. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution via the buffer overflow.

Advisories reference a public proof-of-concept exploit on GitHub, including details and a PoC specific to the Tenda TX3 /goform/SetIpMacBind endpoint. VulDB entries (ctiid.344772, id.344772, submit.747239) document the issue, noting that the exploit has been disclosed to the public and may be used. No patches or specific mitigations are mentioned in the available references.

Details

CWE(s)

Affected Products

tenda
tx3 firmware
≤ 16.03.13.11

CVEs Like This One

CVE-2025-1895Same product: Tenda Tx3
CVE-2025-1896Same product: Tenda Tx3
CVE-2025-1899Same product: Tenda Tx3
CVE-2025-1897Same product: Tenda Tx3
CVE-2025-1898Same product: Tenda Tx3
CVE-2025-8958Same product: Tenda Tx3
CVE-2025-12232Same vendor: Tenda
CVE-2026-7057Same vendor: Tenda
CVE-2025-12622Same vendor: Tenda
CVE-2025-7465Same vendor: Tenda

References