The vulnerability CVE-2026-6015 affects Tenda AC9 firmware version 15.03.02.13. It is a stack-based buffer overflow in the POST request handler component, specifically in the formQuickIndex function processing the PPPOEPassword parameter. An attacker can remotely send a crafted POST request to trigger the overflow, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 base score is 8.7, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch currently available, and the exploit code has been publicly disclosed.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on the affected Tenda AC9 device. The attacker does not require privileges or user interaction to exploit the flaw. Confidentiality, integrity, and availability of the device and potentially the network it serves can be severely impacted. No known exploits in the wild have been reported yet, but public disclosure increases the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, such as restricting remote access to the management interface. Monitor vendor communications for updates and apply firmware updates as soon as they become available.