PT-2026-31876 · Tenda · Ac9

Wxhwxhwxh_Mie · Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-6015

NVD

CVSS v2.0

9.0

High

AV:N/AC:L/Au:S/C:C/I:C/A:C

A vulnerability has been found in Tenda AC9 15.03.02.13. Impacted is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. Such manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Exploit

Fix

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

CVE-2026-6015

Affected Products

Ac9

References · 8

• 🔥 https://lavender-bicycle-a5a.notion.site/Tenda-AC9-QuickIndex-33153a41781f80458940f212f150a4fb?source=copy_link · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6015 · Security Note
• https://vuldb.com/submit/791828 · Note
• https://twitter.com/CVEnew/status/2042561756107837610 · Twitter Post
• https://vuldb.com/vuln/356571 · Note
• https://tenda.com.cn · Note
• https://vuldb.com/vuln/356571/cti · Note
• https://twitter.com/CveFindCom/status/2042493557018099985 · Twitter Post