CVE-2026-6015
Published: 10 April 2026
Summary
CVE-2026-6015 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac9 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents stack-based buffer overflow by enforcing validation and error handling for the PPPOEPassword argument in POST requests to /goform/QuickIndex.
Ensures timely patching or remediation of the specific buffer overflow flaw in Tenda AC9 firmware version 15.03.02.13.
Mitigates exploitation of the stack-based buffer overflow via memory protections like non-executable stacks and address space randomization.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in router web form (/goform/QuickIndex) enables remote exploitation of public-facing application for initial access (T1190) and arbitrary code execution via Unix shell on embedded Linux device (T1059.004).
NVD Description
A vulnerability has been found in Tenda AC9 15.03.02.13. Impacted is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. Such manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. It is possible to launch…
more
the attack remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2026-6015 is a stack-based buffer overflow vulnerability affecting Tenda AC9 routers running firmware version 15.03.02.13. The flaw resides in the formQuickIndex function within the /goform/QuickIndex file of the POST Request Handler component, where improper handling of the PPPOEPassword argument triggers the overflow. Published on 2026-04-10, it is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker with low privileges can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Successful exploitation allows arbitrary code execution, potentially granting high-impact compromise of confidentiality, integrity, and availability on the affected device. The exploit has been publicly disclosed and may be used by adversaries.
Advisories and additional details are documented in references including VulDB entries at https://vuldb.com/vuln/356571 and https://vuldb.com/vuln/356571/cti, a submission at https://vuldb.com/submit/791828, a detailed write-up at https://lavender-bicycle-a5a.notion.site/Tenda-AC9-QuickIndex-33153a41781f80458940f212f150a4fb?source=copy_link, and the vendor site at https://www.tenda.com.cn/.
Details
- CWE(s)