CVE-2026-5548
Published: 05 April 2026
Summary
CVE-2026-5548 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac10 Firmware. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-5548 is a stack-based buffer overflow vulnerability affecting the Tenda AC10 router on firmware version 16.03.10.10_multi_TDE01. The flaw resides in the fromSysToolChangePwd function within the /bin/httpd component, where manipulation of the sys.userpass argument triggers the overflow. Published on 2026-04-05T08:16:24.650, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWEs 119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and 121 (Stack-based Buffer Overflow).
The vulnerability enables remote exploitation by an attacker possessing low privileges, such as an authenticated user on the device. With low attack complexity and no need for user interaction, an adversary can manipulate the argument over the network to overflow the stack, potentially achieving high-impact compromise including arbitrary code execution, data disclosure, modification, and denial of service.
References provide additional details, including a GitHub finding at https://github.com/somanyerrors/tenda-ac10v4-vulnerabilities/blob/main/findings/CRITICAL-04-stackoverflow-fromsystoolchangepwd.md documenting the issue, VulDB entries at https://vuldb.com/vuln/355312 and related pages, and the Tenda website at https://www.tenda.com.cn/. No specific patch or mitigation guidance is detailed in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19044
Vulnerability details
A vulnerability was found in Tenda AC10 16.03.10.10_multi_TDE01. Affected by this vulnerability is the function fromSysToolChangePwd of the file /bin/httpd. Performing a manipulation of the argument sys.userpass results in stack-based buffer overflow. The attack can be initiated remotely.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in public-facing httpd web interface enables remote exploitation (T1190) by low-privilege authenticated users to achieve arbitrary code execution and full compromise (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely patching of the stack-based buffer overflow in the fromSysToolChangePwd function of /bin/httpd to eliminate the vulnerability.
Mandates validation of the sys.userpass argument at the httpd input point to prevent buffer overflow exploitation.
Implements memory protections such as stack canaries and non-executable stacks to block arbitrary code execution from the buffer overflow.