CVE-2026-2140
Published: 08 February 2026
Summary
CVE-2026-2140 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Tx9 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents buffer overflow by validating and sanitizing the deviceList argument in the /goform/setMacFilterCfg function.
Provides memory protections like ASLR, DEP, and stack canaries to mitigate exploitation of the buffer overflow vulnerability.
Ensures timely remediation through firmware updates to address the specific buffer overflow in sub_4223E0.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in router web endpoint (/goform/setMacFilterCfg) directly enables remote exploitation of a public-facing network device application.
NVD Description
A vulnerability was identified in Tenda TX9 up to 22.03.02.10_multi. Affected by this issue is the function sub_4223E0 of the file /goform/setMacFilterCfg. Such manipulation of the argument deviceList leads to buffer overflow. The attack may be launched remotely. The exploit…
more
is publicly available and might be used.
Deeper analysisAI
CVE-2026-2140 is a buffer overflow vulnerability (CWE-119, CWE-120) in Tenda TX9 routers running firmware versions up to 22.03.02.10_multi. The flaw affects the sub_4223E0 function in the /goform/setMacFilterCfg file, triggered by manipulation of the deviceList argument.
The vulnerability enables remote exploitation by an attacker with low privileges (PR:L), requiring low attack complexity, no user interaction, and no scope change. Successful attacks can achieve high impacts on confidentiality, integrity, and availability (CVSS 8.8/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Advisories reference a publicly available proof-of-concept exploit on GitHub, including details on the Tenda TX9 Pro's setMacFilterCfg endpoint, and VulDB entries documenting the issue (CTI ID 344775). No patch or mitigation details are specified in the available information.
Details
- CWE(s)