CVE-2026-2186 HIGH

CVE-2026-2186: Tenda RX3 SetIpMacBind fromSetIpMacBind stack-based overflow

Vendor Tenda

Product RX3

Weakness CWE-121

Published February 8, 2026

Last update February 23, 2026

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability has been found in Tenda RX3 16.03.13.11. Impacted is the function fromSetIpMacBind of the file /goform/SetIpMacBind. Such manipulation of the argument list leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

February 8, 2026 CVE published

February 23, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-2186 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/121.html

Related vulnerabilities

04Related CVE

CVE-2021-26635 Bandisoft ARK Library buffer overflow vulnerability CVE-2021-1182 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities CVE-2026-4534 Tenda FH451 WrlExtraSet formWrlExtraSet stack-based overflow CVE-2025-11012 BehaviorTree Diagnostic Message script_parser.cpp ParseScript stack-based overflow CVE-2024-0931 Tenda AC10U saveParentControlInfo stack-based overflow