CVE-2026-67822 in W6-S

Summary

by MITRE • 07/31/2026

Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length restriction, leading to stack overflow.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Responsible: MITRE
• Reservation: 07/30/2026
• Disclosure: 07/31/2026
• Moderation: accepted
• Entry: VDB-385106
• CPE: ready
• CWE: CWE-121 (confirmed)
• CVSS: 9.9 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: low
• Sector: Industry, Transportation, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-67822
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-67822
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-67822/