CVE-2026-2180
Published: 08 February 2026
Summary
CVE-2026-2180 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Rx3 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-2180 is a stack-based buffer overflow vulnerability in Tenda RX3 firmware version 16.03.13.11. The flaw affects an unknown function in the /goform/fast_setting_wifi_set file, triggered by manipulation of the ssid_5g argument. It is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability enables remote exploitation by attackers with low privileges, such as authenticated users, requiring low complexity and no user interaction. Successful attacks can result in high impacts to confidentiality, integrity, and availability, potentially leading to arbitrary code execution on the device. A public exploit is available, which may facilitate its use in the wild.
Advisories and additional details are provided by VulDB (ctiid.344883, id.344883, submit.749703) and a GitHub issue at LX-66-LX/cve-new/issues/4, along with the vendor site at tenda.com.cn. Security practitioners should review these references for any patch availability or mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5770
Vulnerability details
A vulnerability was identified in Tenda RX3 16.03.13.11. Affected is an unknown function of the file /goform/fast_setting_wifi_set. Such manipulation of the argument ssid_5g leads to stack-based buffer overflow. The attack can be launched remotely. The exploit is publicly available and…
more
might be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in router web interface (/goform/fast_setting_wifi_set) allows remote authenticated attackers to achieve arbitrary code execution, directly enabling T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents stack buffer overflows by enforcing input validation on parameters like ssid_5g at web endpoints such as /goform/fast_setting_wifi_set.
Mitigates exploitation of stack-based buffer overflows through memory protections like stack canaries and address space layout randomization.
Requires timely patching and remediation of the specific buffer overflow flaw in Tenda RX3 firmware version 16.03.13.11.