CVE-2026-67822

CRITICAL

Tenda W6-S 1.0.0.4(510) - Remote Code Execution via Stack-Based Buffer Overflow in wifiSSIDset Endpoint

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-67822. PoCs published by Hunt-Benito.

AI-analyzed exploit summary This repository provides a functional proof-of-concept for CVE-2026-67822, a stack-based buffer overflow in Tenda W6-S's `/goform/wifiSSIDset` endpoint. The PoC includes a confirmed DoS reproducer and a conceptual RCE skeleton demonstrating control-flow hijack via saved $ra overwrite on MIPS BE architecture.

Description

Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length restriction, leading to stack overflow.

Exploits (1)

github WORKING POC

by Hunt-Benito · pythonpoc

https://github.com/Hunt-Benito/go-without-bounds-cve-2026-67822-stack-overflow-in-tenda-w6-s-wifissidset

View Code ZIP pw:eip

This repository provides a functional proof-of-concept for CVE-2026-67822, a stack-based buffer overflow in Tenda W6-S's `/goform/wifiSSIDset` endpoint. The PoC includes a confirmed DoS reproducer and a conceptual RCE skeleton demonstrating control-flow hijack via saved $ra overwrite on MIPS BE architecture.

Classification

Working Poc 99%

Attack Type

Rce | Dos

Complexity

Moderate

Reliability

Reliable

Target: Tenda W6-S wireless access point, firmware v1.0.0.4(510)

No auth needed

Prerequisites: Network access to the Tenda W6-S device (default LAN IP: 192.168.5.10) · For RCE: Firmware-specific gadget addresses or non-NX stack for shellcode execution

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution T1499 - Endpoint Denial of Service

mistral-large-3 · analyzed Aug 07, 2026 Full analysis →

References (1)

Core 1

Core References

https://github.com/Tristerjh/Tenda/blob/main/Tenda_W6-S_GO_overflow.md

View Writeup ZIP pw:eip

Scores

CVSS v3 9.8

EPSS 0.0029

EPSS Percentile 21.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-121

Status published

Published Jul 31, 2026

Tracked Since Jul 31, 2026