CVE-2026-5567

OVERVIEW CVE-2026-5567 is a buffer overflow vulnerability affecting Tenda M3 firmware version 1.0.0.10. The flaw exists in the setAdvPolicyData function within the /goform/setAdvPolicyData endpoint, where improper validation of the policyType parameter allows attackers to trigger a buffer overflow condition. SEVERITY This vulnerability carries a CVSS 3.1 score of 8.8 (HIGH), indicating significant risk. The attack requires network access and low privilege authentication but no user interaction. The impact is severe, with potential for high-level compromise of confidentiality, integrity, and availability. The FAUCET risk score of 52.0/100 reflects moderate but meaningful concern within the broader threat landscape. EXPLOITATION STATUS Public exploit code is available, though the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and shows no evidence of active exploitation in the wild. The EPSS score of 0.00048 suggests minimal real-world exploitation activity relative to the CVE population. However, the availability of published exploits presents a future risk should threat actors begin targeting Tenda M3 devices at scale.