Which versions of Tenda are affected by CVE-2026-4906?

Tenda AC5 routers running firmware version 15.03.06.47 contain a critical remote code execution vulnerability that allows authenticated attackers to compromise device integrity and potentially pivot…

Is there a public PoC exploit available for CVE-2026-4906?

Yes, a public proof-of-concept exploit is available for CVE-2026-4906. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4906?

Within 24 hours: Inventory all Tenda AC5 devices and identify those running firmware 15.03.06.47; isolate affected devices from critical network segments if possible. Within 7 days: Contact Tenda support to confirm patch availability timeline; implement network segmentation to restrict router administrative access to designated jump hosts only; enable all available router logging. Within 30 days: Replace affected Tenda AC5 units with alternative vendor equipment or deploy compensating controls (see below) if replacement is not immediately feasible; conduct network access logs review for suspicious administrative activity.

Tenda CVE-2026-4906

Q: What is the CVSS score of CVE-2026-4906?

CVE-2026-4906 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16524 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-27 VulDB

GHSA-cfmp-f27r-2qg4

Tenda Buffer Overflow Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Mar 31, 2026 - 20:58 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 01:15 euvd

EUVD-2026-16524

Analysis Generated

Mar 27, 2026 - 01:15 vuln.today

CVE Published

Mar 27, 2026 - 00:53 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was determined in Tenda AC5 15.03.06.47. The affected element is the function decodePwd of the file /goform/WizardHandle of the component POST Request Handler. Executing a manipulation of the argument WANT/WANS can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Remote attackers with low-level authentication can trigger stack-based buffer overflow in Tenda AC5 router firmware version 15.03.06.47 via the WizardHandle POST request handler, potentially achieving arbitrary code execution with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists, as confirmed by multiple references including a detailed proof-of-concept document on Notion. The CVSS score of 8.8 reflects network-based attack vector with low complexity and no user interaction required, while the temporal score indicates proof-of-concept exploitation capability.

Technical ContextAI

The vulnerability resides in the decodePwd function within the /goform/WizardHandle component of Tenda AC5 router firmware, classified as CWE-121 (stack-based buffer overflow). The affected product is identified via CPE cpe:2.3:a:tenda:ac5:*:*:*:*:*:*:*:*. The flaw occurs when processing POST requests where manipulation of the WANT or WANS arguments can cause unbounded data to be written to a fixed-size stack buffer, overwriting adjacent memory. Stack-based buffer overflows are particularly dangerous in embedded device firmware as they can lead to control flow hijacking, enabling attackers to execute arbitrary code in the context of the web server process handling configuration requests. The WizardHandle endpoint typically processes router setup and configuration parameters, making it a sensitive attack surface.

RemediationAI

No vendor-released patch or fixed firmware version is identified in the available intelligence sources at time of analysis. Organizations should monitor Tenda's official security advisories at https://www.tenda.com.cn/ for firmware updates addressing CVE-2026-4906. Until patching is possible, implement compensating controls including: disable remote administration interfaces and restrict WAN-side access to the web management interface, implement network segmentation to isolate affected devices from critical infrastructure, enforce strong authentication credentials replacing any default passwords, and monitor for suspicious POST requests to /goform/WizardHandle endpoints in firewall or IDS logs. Consider replacing affected devices with alternative hardware if vendor support is discontinued or patches are not released in a timely manner.