CVE-2026-2185

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A flaw has been found in Tenda RX3 16.03.13.11. This issue affects the function set_device_name of the file /goform/setBlackRule of the component MAC Filtering Configuration Endpoint. This manipulation of the argument devName/mac causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-121

Affected software

Vendor	Product	Versions
Tenda	RX3	16.03.13.11

References

https://github.com/LX-66-LX/cve-new/issues/6Exploit, Issue Tracking
https://vuldb.com/?ctiid.344888Permissions Required, VDB Entry
https://vuldb.com/?id.344888Third Party Advisory, VDB Entry
https://vuldb.com/?submit.749715Third Party Advisory, VDB Entry
https://www.tenda.com.cn/Product

Timeline

Published: Feb 8, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-218506.5HCL AION is affected by a vulnerability where user-controlled input could be included in HTTP response headers without proper neutralization CVE-2026-218515.3MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.1, a Path Traversal (Zip S CVE-2026-218527.5Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositor CVE-2026-218538.8AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.25.4, there is a one-click remote code execution CVE-2026-218549.8The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, an authentication bypass vulnerability in the lo CVE-2026-218556.1The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, a reflected Cross Site Scripting (XSS) vulnerabi CVE-2026-218568.8The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to commit 9bdb3a75a98a7047b6d70144eb1da1655d6992a8, a time based bli CVE-2026-218576.5REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary fil CVE-2026-2185810.0n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on th CVE-2026-218595.3Mailpit is an email testing tool and API for developers. Versions 1.28.0 and below have a Server-Side Request Forgery (SSRF) vulnerability i CVE-2026-21868.8A vulnerability has been found in Tenda RX3 16.03.13.11. Impacted is the function fromSetIpMacBind of the file /goform/SetIpMacBind. Such ma CVE-2026-218605.3Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Wi