CVE-2026-2877
Published: 21 February 2026
Summary
CVE-2026-2877 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda A18 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-2877 is a stack-based buffer overflow vulnerability affecting the Tenda A18 router on firmware version 15.13.07.13, published on 2026-02-21. The flaw exists in the strcpy function within the /goform/WifiExtraSet file of the Httpd Service component, triggered by manipulation of the wpapsk_crypto5g argument. It is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability enables remote exploitation by an attacker possessing low privileges, such as an authenticated user on the network. No user interaction is required, and successful exploitation can result in high-impact compromise of confidentiality, integrity, and availability, potentially allowing arbitrary code execution on the affected device.
Advisories from VulDB (https://vuldb.com/?ctiid.347130, https://vuldb.com/?id.347130, https://vuldb.com/?submit.754703) provide further details on the issue, while the vendor site (https://www.tenda.com.cn/) may offer patching guidance. An exploit has been publicly disclosed on GitHub (https://github.com/master-abc/cve/issues/39) and may be in use.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7592
Vulnerability details
A vulnerability has been found in Tenda A18 15.13.07.13. This affects the function strcpy of the file /goform/WifiExtraSet of the component Httpd Service. The manipulation of the argument wpapsk_crypto5g leads to stack-based buffer overflow. It is possible to initiate the…
more
attack remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the router's Httpd web service (/goform/WifiExtraSet) allows remote authenticated attackers to achieve arbitrary code execution, directly facilitating exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of the stack-based buffer overflow flaw in the Tenda A18 httpd service via firmware patching.
Mandates validation of the wpapsk_crypto5g input argument to prevent triggering the strcpy buffer overflow in the WifiExtraSet handler.
Implements memory protections such as stack canaries and non-executable stacks to mitigate exploitation of the stack-based buffer overflow.