CVE-2026-11498

CVE-2026-11498 is a stack-based buffer overflow in the Tenda router VOIP handler's `asp_voip_OtherSet` function, specifically in how it processes the `funckey_transfer` parameter through the Boa web server. The vulnerability carries a CVSS score that may lead you to deprioritize it—don't. The risk profile here is a textbook case of feature abandonment intersecting with privileged attack surface. The VOIP web management interface runs on Boa, which in Tenda firmware typically executes with elevated privileges and without modern hardening mitigations like stack canaries. A successful overflow doesn't just compromise a checkbox feature—it compromises the device sitting at your network edge that all traffic flows through. That's the blast radius that CVSS alone won't tell you about. Two questions the CVE description leaves unresolved: First, is the `/boaform/voip_other_set` endpoint accessible from WAN in default ISP deployments? If yes, this is a remote unauthenticated compromise. If no, you still shouldn't assume safety—Tenda's web authentication has historically been trivially bypassable through session fixation, and compromised ISP provisioning can turn 'local-only' into 'effectively remote.' Second, what's the actual remediation timeline? Tenda has a well-documented pattern of slow or absent patch delivery for consumer GPON devices. 'Patch available' and 'patch deployed at scale' may be separated by years. For defenders: assume remote exploitation is feasible until proven otherwise. Network-segment these devices aggressively. If you manage ISP-provided edge hardware, verify the management interface is not exposed and consider replacement if the vendor patch cadence is non-existent. The EPSS score of 0.03799 reflects current observation bias—it doesn't capture what happens when a botnet campaign decides to target this handler specifically. The structural likelihood of similar vulnerabilities appearing in the same product line within 24 months is effectively 1.0 based on the historical pattern.

Reviewed through automated stages and approved by a human before publication.