CVE-2026-2930

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-2930
A vulnerability was identified in Tenda A18 15.13.07.13. The affected element is the function webCgiGetUploadFile of the file /cgi-bin/UploadCfg of the component Httpd Service. Such manipulation of the argument boundary leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/master-abc/cve/issues/40 Issue Tracking
https://vuldb.com/?ctiid.347277 Permissions Required VDB Entry
https://vuldb.com/?id.347277 Third Party Advisory VDB Entry
https://vuldb.com/?submit.755227 Third Party Advisory VDB Entry
https://www.tenda.com.cn/ Product
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:tenda:a18_firmware:15.13.07.13:*:*:*:*:*:*:*
cpe:2.3:h:tenda:a18:-:*:*:*:*:*:*:*
History

23 Feb 2026, 20:19

Type Values Removed Values Added
First Time Tenda
Tenda a18 Firmware
Tenda a18
CPE cpe:2.3:o:tenda:a18_firmware:15.13.07.13:*:*:*:*:*:*:*
cpe:2.3:h:tenda:a18:-:*:*:*:*:*:*:*
References () https://github.com/master-abc/cve/issues/40 - () https://github.com/master-abc/cve/issues/40 - Issue Tracking
References () https://vuldb.com/?ctiid.347277 - () https://vuldb.com/?ctiid.347277 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.347277 - () https://vuldb.com/?id.347277 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.755227 - () https://vuldb.com/?submit.755227 - Third Party Advisory, VDB Entry
References () https://www.tenda.com.cn/ - () https://www.tenda.com.cn/ - Product

23 Feb 2026, 18:13

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad fue identificada en Tenda A18 15.13.07.13. El elemento afectado es la función webCgiGetUploadFile del archivo /cgi-bin/UploadCfg del componente Httpd Service. Dicha manipulación del argumento boundary conduce a un desbordamiento de búfer basado en pila. El ataque puede ser ejecutado remotamente. El exploit está disponible públicamente y podría ser utilizado.

22 Feb 2026, 07:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-22 07:16

Updated : 2026-02-23 20:19

NVD link : CVE-2026-2930

Mitre link : CVE-2026-2930

CVE.ORG link : CVE-2026-2930

JSON object : View

Products Affected

tenda

  • a18_firmware
  • a18
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-121

Stack-based Buffer Overflow