CVE-2026-2140

A vulnerability was identified in Tenda TX9 up to 22.03.02.10_multi. Affected by this issue is the function sub_4223E0 of the file /goform/setMacFilterCfg. Such manipulation of the argument deviceList leads to buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used.

• CWE-119
• CWE-120

• https://github.com/MRAdera/IoT-Vuls/blob/main/tenda/tx9%20pro/setMacFilterCfg.mdExploit, Third Party Advisory
• https://github.com/MRAdera/IoT-Vuls/blob/main/tenda/tx9%20pro/setMacFilterCfg.md#pocExploit
• https://vuldb.com/?ctiid.344775Permissions Required, VDB Entry
• https://vuldb.com/?id.344775Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.747251Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.749747Third Party Advisory, VDB Entry
• https://www.tenda.com.cn/Product

Published

Feb 8, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-21388Mattermost Plugins versions <=2.3.1 fail to limit the reques…6.5
• CVE-2026-21389An OS command injection vulnerability exists in XWEB Pro ve…8.8
• CVE-2026-2139A vulnerability was determined in Tenda TX9 up to 22.03.02.1…8.8
• CVE-2026-21391An improper validation vulnerability exists within PingAM wh…9.5
• CVE-2026-21393Movable Type contains a stored cross-site scripting vulnerab…5.4
• CVE-2026-21399Heap-based buffer overflow for the Intel(R) Open Volume Kern…6.9
• CVE-2026-21400Protection mechanism failure for some Intel(R) AI Reference …5.4
• CVE-2026-21404NAVTOR NavBox through version 4.16.1.20 contains hard-coded …6.3
• CVE-2026-21408beat-access for Windows version 3.0.3 and prior contains an …7.3
• CVE-2026-21409Improper authorization vulnerability exists in RICOH Streaml…8.2
• CVE-2026-2141A security flaw has been discovered in WuKongOpenSource Wuko…8.8
• CVE-2026-21410InSAT MasterSCADA BUK-TS is susceptible to SQL Injection thr…9.8