Which versions of Tenda are affected by CVE-2026-4903?

Tenda AC5 wireless routers (firmware 15.03.06.47) contain a critical remote code execution vulnerability that allows authenticated network users to gain complete control of affected devices.

Is there a public PoC exploit available for CVE-2026-4903?

Yes, a public proof-of-concept exploit is available for CVE-2026-4903. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4903?

Within 24 hours: Identify and inventory all Tenda AC5 routers running firmware 15.03.06.47 in your environment; restrict administrative access to these devices to trusted personnel only. Within 7 days: Implement network segmentation to isolate affected routers from sensitive systems; disable remote management features if operationally feasible; establish enhanced monitoring for suspicious POST requests to /goform/QuickIndex. Within 30 days: Evaluate replacement with routers from vendors with active security support; contact Tenda for patched firmware availability; prepare migration plan to eliminate dependency on vulnerable devices.

Tenda CVE-2026-4903

Q: What is the CVSS score of CVE-2026-4903?

CVE-2026-4903 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16472 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-26 VulDB

Buffer Overflow Stack Overflow Tenda

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Mar 31, 2026 - 21:08 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 23:01 euvd

EUVD-2026-16472

Analysis Generated

Mar 26, 2026 - 23:01 vuln.today

CVE Published

Mar 26, 2026 - 22:30 nvd

HIGH 7.4

DescriptionCVE.org

A flaw has been found in Tenda AC5 15.03.06.47. This vulnerability affects the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. This manipulation of the argument PPPOEPassword causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been published and may be used.

AnalysisAI

Remote attackers with low-level credentials can execute arbitrary code on Tenda AC5 wireless routers running firmware version 15.03.06.47 by exploiting a stack-based buffer overflow in the formQuickIndex function via a crafted PPPOEPassword parameter in POST requests to /goform/QuickIndex. Publicly available exploit code exists, including detailed proof-of-concept documentation published on Notion, elevating immediate risk for devices exposed to authenticated network users. The CVSS score of 8.8 reflects high impact across confidentiality, integrity, and availability with network-based attack vector and low complexity.

Technical ContextAI

The vulnerability resides in the formQuickIndex function within the POST request handler at the /goform/QuickIndex endpoint of Tenda AC5 router firmware 15.03.06.47 (CPE: cpe:2.3:a:tenda:ac5:*:*:*:*:*:*:*:*). The root cause is CWE-121, a stack-based buffer overflow occurring when the application fails to validate the length of the PPPOEPassword argument before copying it to a fixed-size stack buffer. This classic memory corruption vulnerability allows attackers to overwrite adjacent memory regions, including the function return address, enabling control of program execution flow. The /goform/ path typically handles router configuration and management functions, where sensitive operations like PPPoE authentication credential management are processed.

RemediationAI

No vendor-released patch identified at time of analysis based on available reference data. Until Tenda releases updated firmware, implement defense-in-depth controls: disable remote management interfaces and restrict administrative access to trusted internal network segments only, change all default credentials to strong unique passwords immediately, implement network segmentation to isolate IoT devices from critical assets, monitor for suspicious POST requests to /goform/QuickIndex endpoints via intrusion detection systems, and consider replacing affected devices with alternative router models if Tenda does not provide timely security updates. Organizations should monitor the vendor security portal at https://www.tenda.com.cn/ and VulDB entry https://vuldb.com/?id.353654 for future patch availability announcements.