CVE-2026-5550 Details

A stack-based buffer overflow vulnerability has been identified in the Tenda AC10 router, specifically in the firmware version 16.03.10.10_multi_TDE01. The issue arises in the HTTPD binary, within the 'fromSysToolChangePwd' function, which is one of 229 call sites that improperly handle NVRAM values. These call sites use fixed-size stack buffers ranging from 16 to 64 bytes, without any length validation, creating a reliable exploitation path. The vulnerability can be exploited remotely, and the absence of stack canaries and address randomization further facilitates exploitation.

It is recommended to add length validation to the 'GetValue()' function, enforce maximum length limits for NVRAM keys, recompile the HTTPD binary with stack protection, and update the router's firmware if possible.