Buffer overflow in the exeCommand handler of Tenda AC9 and AC15

A vulnerability was identified in Tenda AC9 and AC15 15.03.05.14/15.03.05.18. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Such manipulation of the argument cmdinput leads to buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.

• Tenda AC9: versions 15.03.05.14 and 15.03.05.18 are marked affected.
• Tenda AC15: versions 15.03.05.14 and 15.03.05.18 are marked affected.
• The record does not establish whether other versions or branches are affected, does not provide a fixed release, and does not support treating all later versions as safe.

The CNA description identifies formexeCommand in /goform/exeCommand as the vulnerable component and cmdinput as the attacker-controlled argument. VulDB describes the product as copying input into an output buffer without checking whether the input fits, causing a buffer overflow consistent with CWE-120 and CWE-119. The record indicates network reachability, low attack complexity, low privileges, and no user interaction. The request format, buffer sizes, memory layout, and whether reliable code execution follows are not established by the available evidence. The endpoint's default WAN exposure and specific authentication flow are also not documented beyond the stated privilege requirement.

The record supports remote exploitation and indicates low complexity, low privileges, and no user interaction. VulDB reports that technical details and a public proof of concept are available. The referenced GitHub advisory could not be retrieved during research, so its payload and exact exploit steps are not independently confirmed here. The evidence reviewed does not identify a named campaign, victim, or confirmed in-the-wild use.

An attacker who meets the stated privilege precondition could cause memory corruption in the router service. Depending on the resulting memory state, this may lead to service disruption, unauthorized changes, disclosure of router or transit data, or further compromise, but the evidence does not prove each outcome or reliable arbitrary code execution. The normalized impact fields indicate that confidentiality, integrity, and availability may all be seriously affected, while the directly assessed scope is limited to the vulnerable device. Downstream network impact is therefore deployment-dependent.

Successful exploitation could crash the router, alter its behavior, or compromise data handled by the device. Because AC9 and AC15 routers may act as network gateways, compromise could also reduce trust in traffic passing through connected networks or provide a foothold for further activity; these are possible consequences, not confirmed outcomes for every deployment. The available evidence does not establish a breach, named victim, or specific data accessed.

1. Treat Tenda AC9 and AC15 systems running affected firmware as exposed. The record supplies no fixed release, and the CNA page lists no known specific countermeasure.
2. Check Tenda's official support and download channels for a vendor-confirmed update for each model. Do not infer that a later firmware version is fixed unless Tenda explicitly confirms the relevant product branch.
3. Until confirmed vendor guidance or a fix is available, restrict access to the router management interface, including requests reaching /goform/exeCommand, to trusted administration networks, and isolate affected routers where practical.
4. Review device configuration, administrator accounts, and available logs before returning an affected router to a trusted network. Access restrictions and network segmentation reduce risk but are not a verified patch.

1. Inventory Tenda AC9 and AC15 devices and record the firmware running on each device, then compare the results with the versions marked affected in affected_summary.
2. Determine whether the router management plane is reachable from untrusted networks, particularly for requests to /goform/exeCommand.
3. If HTTP or management logs are retained, review requests to this endpoint for unusual values or sizes in cmdinput, repeated processing errors, unexpected crashes, or reboots.
4. Check for unauthorized changes to administrator accounts, DNS settings, firewall rules, port forwarding, and other management settings. These are precautionary review steps, not confirmed indicators for this vulnerability.
5. No specific IOC or log signature is provided. The absence of matching logs, especially on devices with limited history, does not prove that a router is safe.