Which versions of Tenda are affected by CVE-2026-4902?

Tenda AC5 routers running firmware 15.03.06.47 contain a critical remote code execution vulnerability that allows authenticated attackers to gain complete system control, exposing organizations…

Is there a public PoC exploit available for CVE-2026-4902?

Yes, a public proof-of-concept exploit is available for CVE-2026-4902. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4902?

Within 24 hours: Identify and inventory all Tenda AC5 routers running firmware version 15.03.06.47 in your environment; isolate affected devices from critical network segments if possible. Within 7 days: Implement network-level access controls to restrict administrative access to these routers and disable remote management features; consult Tenda support for interim firmware recommendations or workarounds. Within 30 days: Develop a replacement or upgrade plan for affected Tenda AC5 units; monitor Tenda security advisories for patch availability and prepare deployment procedures.

Tenda CVE-2026-4902

Q: What is the CVSS score of CVE-2026-4902?

CVE-2026-4902 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16470 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-26 VulDB

Tenda Buffer Overflow Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Mar 31, 2026 - 01:36 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 23:01 euvd

EUVD-2026-16470

Analysis Generated

Mar 26, 2026 - 23:01 vuln.today

CVE Published

Mar 26, 2026 - 22:30 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was detected in Tenda AC5 15.03.06.47. This affects the function fromAddressNat of the file /goform/addressNat of the component POST Request Handler. The manipulation of the argument page results in stack-based buffer overflow. The attack can be launched remotely. The exploit is now public and may be used.

AnalysisAI

Remote attackers with low-level authentication can achieve full system compromise on Tenda AC5 routers running firmware version 15.03.06.47 by exploiting a stack-based buffer overflow in the addressNat POST request handler. The fromAddressNat function fails to validate the 'page' parameter, enabling memory corruption that leads to high confidentiality, integrity, and availability impact (CVSS 8.8). Publicly available exploit code exists, significantly lowering the barrier to exploitation.

Technical ContextAI

The vulnerability resides in the fromAddressNat function within /goform/addressNat endpoint of Tenda AC5 router firmware, specifically affecting version 15.03.06.47 (CPE: cpe:2.3:a:tenda:ac5:*:*:*:*:*:*:*:*). This is a classic stack-based buffer overflow (CWE-121) where insufficient bounds checking on the 'page' parameter during POST request processing allows an attacker to write beyond allocated stack memory. The POST Request Handler component processes user-supplied input without proper validation, enabling stack memory corruption that can overwrite return addresses and function pointers. Stack-based buffer overflows are particularly dangerous in embedded router firmware because they often lead to arbitrary code execution with the privileges of the web server process, typically running with elevated system access on these devices.

RemediationAI

No vendor-released patch identified at time of analysis from the available references. Organizations should immediately check the Tenda support portal at https://www.tenda.com.cn/ for firmware updates addressing CVE-2026-4902 and apply them as soon as available. Until patching is possible, implement compensating controls including: disable remote administration access to the router's web interface, restrict management access to trusted internal IP addresses only via firewall rules or router access control lists, change all default credentials to strong unique passwords, and monitor authentication logs for suspicious login attempts to /goform/ endpoints. Consider replacing affected devices with alternative products if Tenda does not release security updates, as consumer router vendors sometimes do not support older firmware versions with security patches. Network segmentation should isolate affected routers from critical assets to limit potential post-exploitation lateral movement.