CVE-2026-67822 describes a stack-based buffer overflow in Tenda W6-S firmware version 1.0.0.4(510) at the /goform/wifiSSIDset endpoint. The vulnerable function formwrlSSIDset uses the unsafe sprintf function to copy the user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without bounds checking. This lack of length restriction enables an attacker to overflow the stack buffer, potentially leading to arbitrary code execution or denial of service. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. There is no known patch or vendor remediation information at this time.

Successful exploitation of this vulnerability can result in full system compromise, including arbitrary code execution, data corruption, or denial of service on the affected Tenda W6-S device. The vulnerability allows remote unauthenticated attackers to exploit the flaw over the network without user interaction, posing a severe risk to device security and network integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the vulnerable endpoint and monitor for suspicious activity targeting /goform/wifiSSIDset. Avoid exposing the device to untrusted networks. Follow vendor communications for updates on patches or mitigations.