CVE-2026-2906
Published: 22 February 2026
Summary
CVE-2026-2906 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Hg9 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-2906 is a stack-based buffer overflow vulnerability affecting the Tenda HG9 router with firmware version 300001138. The flaw resides in an unknown function within the /boaform/formSamba file of the Samba Configuration Endpoint, where manipulation of the "sambaCap" argument triggers the overflow. Published on 2026-02-22, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
The vulnerability enables remote exploitation over the network with low attack complexity and no user interaction. It requires low privileges (PR:L), allowing authenticated users with minimal access to trigger the buffer overflow. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially enabling arbitrary code execution on the affected device.
Advisories referenced in VulDB entries (ctiid.347215, id.347215, submit.755193) and a GitHub issue (QIU-DIE/cve-nneeww/issues/8) document the vulnerability details, while the Tenda website (tenda.com.cn) serves as a source for potential vendor guidance.
An exploit for this vulnerability has been publicly released, heightening the risk of real-world attacks against unpatched Tenda HG9 devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7703
Vulnerability details
A security flaw has been discovered in Tenda HG9 300001138. Affected is an unknown function of the file /boaform/formSamba of the component Samba Configuration Endpoint. The manipulation of the argument sambaCap results in stack-based buffer overflow. The attack may be…
more
launched remotely. The exploit has been released to the public and may be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a stack-based buffer overflow in the web-based Samba configuration endpoint (/boaform/formSamba) of a network-accessible router, enabling remote arbitrary code execution with low privileges required, directly facilitating T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation requires applying vendor patches or firmware updates to eliminate the stack-based buffer overflow in the sambaCap argument handler.
Information input validation enforces bounds checking and sanitization of the sambaCap argument to prevent buffer overflow exploitation in the /boaform/formSamba endpoint.
Memory protection mechanisms like stack canaries, ASLR, and non-executable stacks mitigate successful exploitation of the stack-based buffer overflow even if input validation fails.