Dashboard / CVE-2026-6015

CVE-2026-6015

HIGH
MEDIUM Priority: 0.06 BB Relevance: 65/100
Published: 2026-04-10 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: High
VI: High
VA: High

Description

A vulnerability has been found in Tenda AC9 15.03.02.13. Impacted is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. Such manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
tenda ac9_firmware 15.03.02.13

References & Advisories (5)

https://vuldb.com/submit/791828
Third Party Advisory VDB Entry
https://vuldb.com/vuln/356571
Third Party Advisory VDB Entry
https://vuldb.com/vuln/356571/cti
Permissions Required VDB Entry

Bug Bounty Relevance

65 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.4 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.81%
Raw Score 0.008110
Percentile 56.8%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00811
2026-10-28
0.00811

Intelligence Sources

nvd ref →

External Links