CVE-2026-3400 is a high severity (CVSS 8.8) stack-based buffer overflow in Tenda AC15 router firmware up to 15.13.07.13. The record says an exploit has been published. No fixed firmware version is listed in the record, so check Tenda for an update and keep the router's admin interface off untrusted networks.
What's affected
The record names the Tenda AC15 and its firmware, up to and including version 15.13.07.13. The flaw sits in the handler for the /goform/TextEditingConversion page, and the argument called wpapsk_crypto2_4g is the one that triggers the overflow.
The record does not list a fixed firmware release. The vendor page it points to is the Tenda home site, which does not carry an advisory I could confirm. Treat every AC15 on 15.13.07.13 or earlier as affected until Tenda says otherwise.
How to check if you're exposed
Log in to the router's admin page and open the system status or firmware page. The firmware version is shown there. Anything at or below 15.13.07.13 is in scope.
Also check who can reach that admin page. The CVSS vector shows network access with low privileges required, which means an attacker needs a login first. A router that exposes its management interface to the internet, or that shares a flat network with guests, is the worst case.
If you manage many branch or home offices, ask your inventory tool or network scanner for devices whose banner reports an AC15.
What to do now
- Find every Tenda AC15 and note its firmware version.
- Check the Tenda support site for a firmware newer than 15.13.07.13 and apply it if one exists. The record does not confirm one.
- Turn off remote management so the admin page is reachable only from the inside network.
- Change the admin password to a long, unique one, since the flaw needs an authenticated session.
- Keep guests and IoT devices on a separate network from the one that can reach the admin page.
- If the device cannot be fixed and sits in a sensitive place, plan to replace it.
Why it matters
The record lists CWE-119 (improper restriction of operations within a memory buffer), CWE-121 (stack-based buffer overflow) and CWE-787 (out-of-bounds write). In plain terms, the firmware copies a request value into a fixed-size stack buffer without checking its length. On a router that can overwrite nearby memory, and the result is usually a crash or code execution on the device.
The record does not mark this CVE as exploited in the wild and it is not on the CISA KEV list. It does say a public exploit exists, which lowers the effort for anyone who can log in to the router.
Quick check
Does this affect routers that are not exposed to the internet?
It can. The attacker needs network access to the admin page and a login. A router that only your own staff can reach is lower risk, but a compromised laptop on the same network would meet that bar.
Sources
Last reviewed: 19 October 2026.
