Tenda CVE-2026-4903

Requires authenticated access to Tenda AC5 router (version 15.03.06.47). Attacker must send a crafted POST request to /goform/QuickIndex with oversized PPPOEPassword parameter. No victim interaction needed. Remote exploitation requires valid router credentials.

Real-world risk is elevated due to convergence of multiple threat indicators. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-accessible exploitation with low complexity requiring only low-privilege authentication and no user interaction, achieving complete system compromise. Critically, publicly available exploit code exists with detailed technical documentation hosted on Notion, significantly lowering the barrier for exploitation. The E:P (Proof-of-concept) temporal modifier confirms exploit code maturity. However, the PR:L requirement means attackers need authenticated access, limiting exploitation to scenarios where default credentials are unchanged, credential reuse occurs, or lateral movement from compromised networks. While not confirmed as actively exploited in CISA KEV, the combination of public exploit availability, IoT device target class (often unpatched), and complete system impact makes this a genuine priority for organizations deploying Tenda AC5 routers, particularly those internet-exposed or in environments with weak credential hygiene.

An attacker who has obtained low-privilege credentials (through default passwords, credential stuffing, or prior compromise of network devices) authenticates to the Tenda AC5 web management interface. They craft a malicious POST request to /goform/QuickIndex containing an oversized PPPOEPassword parameter designed to overflow the stack buffer and redirect execution to attacker-controlled shellcode. Publicly available exploit code exists with detailed technical documentation on Notion, enabling even moderately skilled attackers to adapt the proof-of-concept for their environment. Successful exploitation grants complete control over the router, enabling network traffic interception, DNS hijacking, or pivot points for further lateral movement.