CVE-2026-2876
Published: 21 February 2026
Summary
CVE-2026-2876 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda A18 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates the deviceList argument in parse_macfilter_rule to prevent stack-based buffer overflow from malformed or oversized inputs.
Implements memory protections like stack canaries and non-executable stacks to mitigate exploitation of the buffer overflow vulnerability.
Remediates the specific stack-based buffer overflow flaw in /goform/setBlackRule through timely patching and flaw correction processes.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in router's web management interface (/goform/setBlackRule) allows remote exploitation over network (AV:N/PR:L) for code execution, directly mapping to T1190 (Exploit Public-Facing Application) and T1210 (Exploitation of Remote Services).
NVD Description
A vulnerability was determined in Tenda A18 15.13.07.13. This affects the function parse_macfilter_rule of the file /goform/setBlackRule. This manipulation of the argument deviceList causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and…
more
may be utilized.
Deeper analysisAI
CVE-2026-2876 is a stack-based buffer overflow vulnerability affecting the Tenda A18 router on firmware version 15.13.07.13, published on 2026-02-21. The flaw exists in the parse_macfilter_rule function of the /goform/setBlackRule file, where manipulation of the deviceList argument triggers the overflow. It is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability is remotely exploitable over the network with low attack complexity, requiring low privileges such as basic authentication but no user interaction. An attacker could send a crafted request to the affected endpoint, causing the buffer overflow and potentially achieving high impacts including unauthorized access to sensitive data, modification of system integrity, or denial of service through crashes or code execution.
Advisories on VulDB (ctiid.347114, id.347114, submit.754675) and a GitHub issue (master-abc/cve/issues/38) document the vulnerability details, noting that the exploit has been publicly disclosed and may be utilized. The Tenda manufacturer's website (tenda.com.cn) is referenced for potential further information.
Details
- CWE(s)