CVE-2026-11528: Tenda AC18 Web Management getRebootStatus sub_45304 stack-based overflow

Synopsis

A stack-based buffer overflow exists in the Tenda AC18 router firmware (version 15.03.05.05) within the getRebootStatus handler of the web management interface. The vulnerability is reachable over the network by an authenticated attacker with low-privilege credentials, triggered by sending a crafted callback argument to the /goform/getRebootStatus endpoint. Successful exploitation gives the attacker full control over the device, including the ability to read stored configuration data, modify device settings, and crash or hijack the running firmware process. No fix version has been published; HarborGuard tracks this advisory and will make a patched rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the web management interface over the network; the vulnerable endpoint is exposed via the device's HTTP server.

• AuthenticationRequired

  A low-privilege account on the web management interface is sufficient to reach the vulnerable endpoint and trigger the overflow.

• Victim interactionNot required

  No action from another user or victim is needed; the attacker sends the crafted request directly.

• Attack complexityDetail

  Exploit complexity is low, meaning the overflow is reliably triggered without needing specific memory layouts, race conditions, or environmental prerequisites.

Blast Radius

• Reads stored configuration data from the device, including Wi-Fi credentials, admin passwords, and network topology settings.
• Modifies device configuration, allowing the attacker to redirect DNS, open firewall rules, or enroll the device in a botnet.
• Crashes the web management process or the full firmware, causing a denial of service and potentially a reboot loop.
• Achieves arbitrary code execution in the context of the firmware process, giving the attacker persistent control over the device.