Which versions of Tenda are affected by CVE-2026-4904?

Tenda AC5 routers running firmware 15.03.06.47 are vulnerable to remote code execution through a stack buffer overflow in the device management interface, allowing authenticated attackers to gain…

Is there a public PoC exploit available for CVE-2026-4904?

Yes, a public proof-of-concept exploit is available for CVE-2026-4904. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4904?

Within 24 hours: Identify all Tenda AC5 routers on the network and document firmware versions via device inventory or management console. Within 7 days: Implement network segmentation to restrict direct access to router management interfaces (restrict /goform/setcfm to administrative network only) and enforce strong authentication on all device admin accounts. Within 30 days: Monitor Tenda security advisories for patched firmware release; if no patch is released within 60 days, develop replacement plan for affected devices or deploy mitigation via reverse proxy/WAF.

Tenda CVE-2026-4904

Q: What is the CVSS score of CVE-2026-4904?

CVE-2026-4904 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16474 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-26 VulDB

Tenda Buffer Overflow Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Mar 31, 2026 - 20:59 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 23:31 euvd

EUVD-2026-16474

Analysis Generated

Mar 26, 2026 - 23:31 vuln.today

CVE Published

Mar 26, 2026 - 23:11 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability has been found in Tenda AC5 15.03.06.47. This issue affects the function formSetCfm of the file /goform/setcfm of the component POST Request Handler. Such manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Stack-based buffer overflow in Tenda AC5 router firmware version 15.03.06.47 enables remote authenticated attackers to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The vulnerability resides in the formSetCfm function's handling of the funcpara1 parameter in POST requests to /goform/setcfm. A publicly available exploit exists with proof-of-concept code disclosed through VulDB and documented in detailed technical write-ups, significantly lowering the barrier to exploitation for threat actors targeting vulnerable devices.

Technical ContextAI

The vulnerability affects the Tenda AC5 wireless router (CPE: cpe:2.3:a:tenda:ac5:*:*:*:*:*:*:*:*) firmware version 15.03.06.47, specifically in the POST request handler component. The root cause is a CWE-121 stack-based buffer overflow in the formSetCfm function when processing the funcpara1 argument via the /goform/setcfm endpoint. Stack-based buffer overflows occur when a program writes more data to a buffer located on the stack than it was allocated for, potentially overwriting adjacent memory including return addresses and function pointers. In embedded device firmware like router operating systems, these vulnerabilities are particularly dangerous as they can lead to complete device compromise, allowing attackers to manipulate network traffic, establish persistent backdoors, or pivot into connected networks.

RemediationAI

No vendor-released patch or firmware update version has been identified in the available data at time of analysis. Users should monitor Tenda's official website at https://www.tenda.com.cn/ for firmware security updates addressing CVE-2026-4904. Until a patch becomes available, implement network-level mitigations including disabling remote administration interfaces, restricting administrative access to trusted IP addresses only via firewall rules, enforcing strong unique passwords on router admin accounts, and placing affected devices behind additional network segmentation boundaries. Organizations should consider replacing affected devices with alternative products if Tenda does not release timely security updates, as consumer router vendors often have limited patch lifecycles. Monitor VulDB references at https://vuldb.com/?id.353655 and https://vuldb.com/?ctiid.353655 for updates on vendor response and community-developed mitigations.