CVE-2026-4489

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was detected in Tenda A18 Pro 02.03.02.28. This vulnerability affects the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set. The manipulation results in stack-based buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-121

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-448907.5Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Fin CVE-2026-448917.5Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.CVE-2026-448927.5Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, the default configu CVE-2026-448937.5Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.F CVE-2026-448947.5Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the tokenHandler used when t CVE-2026-448959.2GitLab MCP Server lets an AI agent talk directly to GitLab. Prior to 0.6.0, the HTTP transport in src/transport.ts ships with no authenticat CVE-2026-448966.1Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, in src/mistune/directives/image.py, the render_figure(CVE-2026-448976.1Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, HTMLRenderer.heading() builds the opening <hN> tag by string CVE-2026-448986.1Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_toc_ul() builds a <ul> table-of-contents tree from a CVE-2026-448996.1Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the Image directive plugin validates the :width: and :height CVE-2026-44908.8A flaw has been found in Tenda A18 Pro 02.03.02.28. This issue affects the function setSchedWifi of the file /goform/openSchedWifi. This man CVE-2026-449008.1epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.1, in SignedPublicKeysTrustValidatorIm