Skip to content
OpenAdvisories
High · 8.8 Public exploit CVE-2026-4961 EUVD-2026-16724GHSA-qhww-r997-h23m

Tenda AC6 POST Request QuickIndex formQuickIndex stack-based overflow

Published Mar 27, 2026 · Updated Mar 27, 2026 · Assigned by VulDB

Vendor: Tenda Product: AC6

Description

A vulnerability was identified in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

Affected products

VendorProductAffectedFixed
Tenda AC6 15.03.05.16 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References