CVE-2026-4567 Details

A stack-based buffer overflow vulnerability has been identified in the Tenda A15 router running version 15.13.07.13. The issue arises in the web management interface, specifically within the UploadCfg function of the /cgi-bin/UploadCfg file. The vulnerability is triggered by manipulating the File argument, which allows for the upload of firmware or configuration files. The underlying cause is a lack of proper bounds checking on the boundary field of multipart/form-data messages. This oversight enables an attacker to send a malicious HTTP POST request with an excessively long boundary string, which the server then copies into a fixed-length buffer on the stack, approximately 68 bytes in size. This exploitation can be conducted remotely and does not require authentication.