Which versions of Tenda are affected by CVE-2026-4905?

Tenda AC5 routers running firmware 15.03.06.47 are vulnerable to remote code execution through an authenticated stack-based buffer overflow, allowing low-privilege users to completely compromise…

Is there a public PoC exploit available for CVE-2026-4905?

Yes, a public proof-of-concept exploit is available for CVE-2026-4905. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4905?

Within 24 hours: Identify all Tenda AC5 devices running firmware 15.03.06.47 in your network inventory and document their location and business criticality. Within 7 days: Restrict administrative and WPS configuration access to trusted networks only using firewall rules; disable WPS functionality if not operationally required; isolate affected routers to a monitored VLAN with egress filtering. Within 30 days: Evaluate replacement with alternative router models from vendors with active security support; contact Tenda for patch availability timeline; implement continuous monitoring of Tenda security advisories for patched firmware releases.

Tenda CVE-2026-4905

Q: What is the CVSS score of CVE-2026-4905?

CVE-2026-4905 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16476 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-26 VulDB

Tenda Buffer Overflow Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Mar 31, 2026 - 20:59 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 23:31 euvd

EUVD-2026-16476

Analysis Generated

Mar 26, 2026 - 23:31 vuln.today

CVE Published

Mar 26, 2026 - 23:11 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was found in Tenda AC5 15.03.06.47. Impacted is the function formWifiWpsOOB of the file /goform/WifiWpsOOB of the component POST Request Handler. Performing a manipulation of the argument index results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

AnalysisAI

Remote authenticated attackers can execute arbitrary code on Tenda AC5 routers (firmware version 15.03.06.47) by exploiting a stack-based buffer overflow in the WPS configuration handler. The vulnerability resides in the formWifiWpsOOB function handling POST requests to /goform/WifiWpsOOB, where insufficient validation of the 'index' parameter allows memory corruption. A publicly available exploit code exists (CVSS 8.8, EPSS data not provided), enabling authenticated attackers with low-privilege access to achieve complete device compromise with high impact on confidentiality, integrity, and availability.

Technical ContextAI

The vulnerability affects the Tenda AC5 wireless router (CPE: cpe:2.3:a:tenda:ac5:*:*:*:*:*:*:*:*) running firmware version 15.03.06.47. The root cause is classified as CWE-121 (Stack-based Buffer Overflow), occurring in the formWifiWpsOOB function within the POST request handler for the /goform/WifiWpsOOB endpoint. This endpoint appears to handle Wi-Fi Protected Setup (WPS) Out-Of-Band configuration operations. The vulnerability arises when processing the 'index' parameter without proper bounds checking, allowing an attacker to write beyond the allocated stack buffer and overwrite adjacent memory, including return addresses and function pointers. Stack-based buffer overflows in embedded device firmware often lead to complete control flow hijacking due to limited memory protection mechanisms like ASLR or DEP commonly absent in IoT devices.

RemediationAI

No vendor-released patch or updated firmware version has been identified in the available intelligence sources at time of analysis. Until Tenda releases a security update addressing CVE-2026-4905, organizations should implement the following compensatory controls: disable remote management interfaces and restrict administrative access to trusted internal IP addresses only; change default administrative credentials to strong, unique passwords to mitigate the low-privilege authentication requirement; implement network segmentation to isolate IoT devices including routers from critical network segments; disable WPS functionality entirely if not operationally required, as the vulnerable endpoint handles WPS configuration; and monitor the vendor security page at https://www.tenda.com.cn/ for forthcoming firmware updates. Consider replacing affected devices with alternative products if vendor support is insufficient or delayed.