CVE-2026-4960 - Vulnerability Analysis

Overview

Tenda AC6 15.03.05.16 contains a stack-based buffer overflow caused by manipulation of the WANT/WANS argument in /goform/WizardHandle POST request handler, letting remote attackers execute code, exploit requires crafted request.

Severity & Score

Impact

Remote attackers can execute arbitrary code, potentially leading to full system compromise.

Mitigation

Update to the latest version.

References

• https://vuldb.com/?ctiid.353837
• https://vuldb.com/?id.353837
• https://vuldb.com/?submit.777616
• https://www.tenda.com.cn/
• https://lavender-bicycle-a5a.notion.site/Tenda-AC6-WizardHandle-32053a41781f800eb05feb16885747f7?source=copy_link

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 27, 2026

🟠 CVE-2026-4960 - High (8.8) A vulnerability was determined in Tenda AC6 15.03.05.16. Affected is the function fromWizardHandle of the file /goform/WizardHandle of the component POST Request Handler. Executing a manipulation of the argument WANT/WANS can lead to stack-based b... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4960/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner