Vulnerability · Published Apr 5, 2026 · Assigned by VulDB
CVE-2026-5550Tenda AC10 httpd fromSysToolChangePwd stack-based overflow
High 8.8
In plain English
A high-severity stack buffer overflow in AC10 from Tenda. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 55.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability was identified in Tenda AC10 16.03.10.10_multi_TDE01. This affects the function fromSysToolChangePwd of the file /bin/httpd. The manipulation leads to stack-based buffer overflow. The attack may be initiated remotely. Multiple endpoints might be affected.
Affected products (as reported)
Weakness: CWE-121, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R
References
- VDB-355314 | Tenda AC10 httpd fromSysToolChangePwd stack-based overflow vdb-entry, technical-description
- VDB-355314 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #782299 | Tenda AC10 V4 US_AC10V4.0si_V16.03.10.10_multi_TDE01 Stack-based Buffer Overflow third-party-advisory
- https://github.com/somanyerrors/tenda-ac10v4-vulnerabilities/blob/main/findings/HIGH-01-getvalue-229-callers.md related
- https://www.tenda.com.cn/ product