VYPR
← All advisories
Critical severity9.8NVD Advisory· Published May 22, 2020· Updated Jun 17, 2026

CVE-2020-13391

CVE-2020-13391

Description

An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/SetSpeedWan speed_dir parameter for a POST request, a value is directly used in a sprintf to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

10
  • Tenda/Ac15 Firmware
    cpe:2.3:o:tendacn:ac15_firmware:v15.03.05.19_multi_td01:*:*:*:*:*:*:*
  • Tenda/Ac18 Firmware
    cpe:2.3:o:tendacn:ac18_firmware:v15.03.05.19\(6318\):*:*:*:*:*:*:*
  • Tenda/Ac6 Firmware
    cpe:2.3:o:tendacn:ac6_firmware:v15.03.05.19_multi_td01:*:*:*:*:*:*:*
  • Tenda/Ac9 Firmware2 versions
    cpe:2.3:o:tendacn:ac9_firmware:v15.03.05.19\(6318\):*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:tendacn:ac9_firmware:v15.03.05.19\(6318\):*:*:*:*:*:*:*
    • cpe:2.3:o:tendacn:ac9_firmware:v15.03.06.42_multi:*:*:*:*:*:*:*
  • Tenda/router's web serverdescription
  • Tenda/AC6llm-fuzzy
    Range: V1.0 V15.03.05.19_multi_TD01
  • Tenda/AC9llm-fuzzy
    Range: V1.0 V15.03.05.19(6318)_CN, V3.0 V15.03.06.42_multi
  • Tenda/AC15llm-fuzzy
    Range: V1.0 V15.03.05.19_multi_TD01
  • Tenda/AC18llm-fuzzy
    Range: V15.03.05.19(6318_)_CN

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.