CVE-2026-2202

HIGH

Tenda Ac8 Firmware - Memory Corruption

Title source: rule

Description

A vulnerability was detected in Tenda AC8 16.03.33.05. Affected is the function fromSetWifiGusetBasic of the file /goform/WifiGuestSet of the component httpd. The manipulation of the argument shareSpeed results in buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.

References (6)

[Third Party Advisory, VDB Entry] https://vuldb.com/?id.344905

[Permissions Required, VDB Entry] https://vuldb.com/?ctiid.344905

[Third Party Advisory, VDB Entry] https://vuldb.com/?submit.750225

[Exploit, Third Party Advisory] https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/Tenda/AC8/WifiGuestSet-sharespeed-bufferoverflow.md

View Exploit ZIP pw:eip

[Exploit, Third Party Advisory] https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/Tenda/AC8/WifiGuestSet-sharespeed-bufferoverflow.md#poc

[Product] https://www.tenda.com.cn/

Scores

CVSS v3 8.8

EPSS 0.0011

EPSS Percentile 29.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-120 CWE-119

Status published

Products (1)

tenda/ac8_firmware 16.03.33.05

Published Feb 09, 2026

Tracked Since Feb 18, 2026