Tenda AC5 CVE-2026-105778

Exploitation requires network reachability to the Tenda AC5 router's HTTP web management interface and low-privilege authentication (PR:L) - i.e., a valid or guessable administrative session/credentials - after which a crafted /goform/setWifi request with an oversized wifiPwd argument triggers the stack overflow. Limiting factors: the attack targets firmware version 02.03.01.111_multi specifically, requires the management interface to be accessible to the attacker (commonly LAN-side unless the device exposes remote management to the WAN), and requires prior authentication, so it is not exploitable by a fully unauthenticated remote attacker against a hardened default configuration.

This is a stack-based buffer overflow (CWE-121) in the Tenda AC5 router's web management interface (/goform/setWifi, wifiPwd parameter). The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with high impact across both vulnerable and subsequent systems (VC/VI/VA:H, SC/SI/SA:H) scores 8.6 and indicates a network-reachable, low-complexity attack requiring low privileges and no user interaction. The E:P (Proof-of-Concept) exploit maturity aligns with the reported publicly available exploit, so this is 'publicly available exploit code exists' - NOT confirmed active exploitation. There is no CISA KEV listing and no EPSS score was provided, so widespread automated exploitation cannot be asserted; absence of these signals means real-world exploitation volume is unknown rather than high. The key tension: CVSS treats this as network-exploitable (AV:N) with PR:L, but PR:L means an attacker must already hold valid (even low-level) credentials or an authenticated session to the router admin interface, which materially limits unauthenticated internet-wide exploitation. Realistic priority is moderate-to-high for exposed/credential-weak devices but lower where the management interface is not internet-facing and default credentials have been changed. No vendor patch is referenced, raising the practical risk for deployed devices.

An attacker with network access to the Tenda AC5 web management interface and low-privilege authentication submits a crafted request to /goform/setWifi containing an oversized wifiPwd value, overflowing a stack buffer in the Wifi Handler. Public exploit code exists (GitHub PoC by raisecnull), lowering the skill barrier to trigger the overflow and potentially achieve code execution or a denial of service on the router. Because PR:L is required, exploitation presupposes a reachable admin interface and valid or guessable credentials.