Loading story…
Two router vulnerabilities have been disclosed that expose D-Link DIR-513 and Tenda A18 Pro devices to remotely triggered stack-based buffer overflows. CVE-2026-4486 affects D-Link DIR-513 version 1.10 in the web service function formEasySetPassword at the /goform/formEasySetPassword endpoint, where a crafted curTime argument can trigger memory corruption. The issue is classified under CWE-119 and CWE-121, and the affected D-Link product is no longer supported by the vendor.
A separate flaw, CVE-2026-4491, impacts Tenda A18 Pro firmware 02.03.02.28 in the fromSetIpMacBind function exposed through /goform/SetIpMacBind. The vulnerability can be exploited remotely with low attack complexity and low privileges by manipulating request arguments, resulting in a stack-based overflow. Both CVEs were reported as publicly exploitable, with references indicating proof-of-concept or exploit details are already available, increasing the risk to internet-exposed and unpatched devices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A new CVE entry documented a stack-based buffer overflow in the fromSetIpMacBind function of the /goform/SetIpMacBind endpoint on Tenda A18 Pro firmware 02.03.02.28. The vulnerability was described as remotely exploitable with public exploit disclosure noted.
A new CVE entry documented a stack-based buffer overflow in the formEasySetPassword function of the /goform/formEasySetPassword endpoint on D-Link DIR-513 routers running version 1.10. The flaw can be triggered remotely via manipulation of the curTime argument, and the CVE notes the product is no longer supported by D-Link.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities, **CVE-2026-4489** and **CVE-2026-4490**, were disclosed in **Tenda A18 Pro** firmware version `02.03.02.28`, exposing the device to remotely triggered stack-based buffer overflows. The flaws affect the `form_fast_setting_wifi_set` function in the `/goform/fast_setting_wifi_set` endpoint and the `setSchedWifi` function in the `/goform/openSchedWifi` endpoint, respectively. Both issues are classified under **CWE-119** and **CWE-121**, indicating improper bounds handling in stack memory operations. The CVE records state that **public exploits are available**, raising the likelihood of real-world compromise against exposed devices. Both entries were scored as high impact across confidentiality, integrity, and availability in published **CVSS v4.0, v3.1, and v2** vectors, indicating that successful exploitation could enable attackers to crash services or potentially execute arbitrary code on vulnerable Tenda A18 Pro systems.
Jun 29, 2026
Two high-severity vulnerabilities have been disclosed in Tenda routers, both enabling remote stack-based buffer overflows through exposed `/goform/` endpoints. **CVE-2026-4551** affects the Tenda **F453** running version `1.0.0.3`, where the `fromSafeClientFilter` function in the `/goform/SafeClientFilter` handler can be exploited by manipulating the `menufacturer/Go` argument. **CVE-2026-5990** affects the Tenda **F451** running version `1.0.0.7`, where the `fromSafeEmailFilter` function in the `/goform/SafeEmailFilter` component can be triggered via the `page` argument. Both flaws are classified under **CWE-119** and **CWE-121** and are described as remotely exploitable with **public exploit information available**, raising the risk of active abuse against exposed devices. The CVE records assign high impact across **confidentiality, integrity, and availability** in published CVSS scoring, indicating that successful exploitation could give attackers a powerful path to compromise vulnerable edge networking equipment.
Jun 29, 2026
Two high-severity vulnerabilities have been disclosed in Tenda router firmware, affecting **FH451 1.0.0.9** and **F453 1.0.0.3**. The flaws are tracked as `CVE-2026-4534` and `CVE-2026-4552` and both involve remotely reachable stack-based buffer overflows in web management handlers. In the FH451 case, the issue is in the `formWrlExtraSet` function exposed through the `/goform/WrlExtraSet` component, where manipulation of the `GO` argument can trigger memory corruption. In the F453 case, the vulnerable code is the `fromVirtualSer` function behind the `/goform/VirtualSer` endpoint, where the `page` argument can be abused to cause a similar overflow. Both CVE records indicate that **public exploits are available**, increasing the likelihood of opportunistic attacks against exposed devices. The disclosures map the weaknesses to `CWE-119` and `CWE-121`, reflecting out-of-bounds memory handling and stack-based buffer overflow conditions, and the published scoring points to high impact on confidentiality, integrity, and availability. Organizations using these Tenda models should treat the flaws as urgent remote compromise risks, especially where router administration interfaces are internet-accessible.
Jun 29, 2026