The vulnerability CVE-2026-6016 affects Tenda AC9 firmware version 15.03.02.13. It is a stack-based buffer overflow in the decodePwd function of the /goform/WizardHandle POST request handler. An attacker can remotely trigger this overflow by manipulating the WANS argument in the POST request. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability state is published, but no remediation level or patch information is provided by the vendor or authoritative sources.

Successful exploitation of this vulnerability could allow a remote attacker to cause a stack-based buffer overflow, potentially leading to arbitrary code execution or denial of service on the affected device. Given the network attack vector and no required privileges or user interaction, the risk is significant for exposed devices running the vulnerable firmware. However, there are no confirmed reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit network exposure of the affected device, especially restricting access to the /goform/WizardHandle endpoint from untrusted networks. Monitor vendor channels for updates and apply firmware updates promptly once available.