CVE-2026-2139

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was determined in Tenda TX9 up to 22.03.02.10_multi. Affected by this vulnerability is the function sub_432580 of the file /goform/fast_setting_wifi_set. This manipulation of the argument ssid causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
Tenda	TX9	22.03.02.10_multi

References

https://github.com/MRAdera/IoT-Vuls/blob/main/tenda/tx9%20pro/fast_setting_wifi_set.mdExploit, Third Party Advisory
https://github.com/MRAdera/IoT-Vuls/blob/main/tenda/tx9%20pro/fast_setting_wifi_set.md#pocExploit
https://vuldb.com/?ctiid.344774Permissions Required, VDB Entry
https://vuldb.com/?id.344774Third Party Advisory, VDB Entry
https://vuldb.com/?submit.747250Third Party Advisory, VDB Entry
https://www.tenda.com.cn/Product

Timeline

Published: Feb 8, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-213919.5An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be s CVE-2026-213934.8Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an attacker, arbitrary scri CVE-2026-213996.1Heap-based buffer overflow for the Intel(R) Open Volume Kernel Library (Intel(R) Open VKL) library maintained by intel(R) before version 2.0 CVE-2026-21408.8A vulnerability was identified in Tenda TX9 up to 22.03.02.10_multi. Affected by this issue is the function sub_4223E0 of the file /goform/s CVE-2026-214006.7Protection mechanism failure for some Intel(R) AI Reference Models before version v3.4.1 within Ring 3: User Applications may allow an escal CVE-2026-214046.3NAVTOR NavBox through version 4.16.1.20 contains hard-coded credentials within its Windows Communication Foundation (SOAP) implementation. I CVE-2026-214076.8Deadlock for some Intel(R) Arc(TM) B-series graphics cards within Ring 1: Device Drivers may allow a denial of service. Unprivileged softwar CVE-2026-214085.4beat-access for Windows version 3.0.3 and prior contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Lin CVE-2026-214098.2Improper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3. If a man-in-the-middle attack is conducted on the communic CVE-2026-21418.8A security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3. This affects an unknown part of the file gateway/src/main/ja CVE-2026-214109.8InSAT MasterSCADA BUK-TS is susceptible to SQL Injection through its main web interface. Malicious users that use the vulnerable endpoint ar CVE-2026-214118.7Authentication bypass issue exists in OpenBlocks series versions prior to FW5.0.8, which may allow an attacker to bypass administrator authe