Tenda CVE-2026-4906

Requires authenticated access to Tenda AC5 router running firmware 15.03.06.47. Attacker must send POST request to /goform/WizardHandle with malicious WANT or WANS parameter to trigger stack-based buffer overflow in decodePwd function.

This vulnerability presents significant real-world risk due to convergence of multiple threat indicators. The CVSS:3.1 base score of 8.8 (High) is driven by network attack vector (AV:N), low complexity (AC:L), and high impact across all CIA triad dimensions. The temporal metrics show proof-of-concept exploit availability (E:P) with reported confidence (RC:R), which aligns with the confirmed public exploit disclosure via VulDB and the detailed Notion document. Authentication is required (PR:L), providing minimal barrier as many IoT devices use default or weak credentials. The attack requires no user interaction (UI:N) and is not automatable in the traditional sense but could be incorporated into IoT botnet scanning tools. Stack-based buffer overflows in router firmware are high-priority targets as they provide persistent network-level access. While no EPSS score or KEV status is provided in the input data, the combination of public exploit availability, internet-facing attack surface, and embedded device context elevates this beyond typical high-CVSS vulnerabilities to an actionable threat requiring immediate attention for organizations using affected devices.

An authenticated attacker on the network (potentially using default or brute-forced credentials) sends a specially crafted POST request to the /goform/WizardHandle endpoint with oversized WANT or WANS parameter values. The decodePwd function copies this malicious input into a fixed-size stack buffer without bounds checking, overwriting the return address and redirecting execution to attacker-controlled shellcode. Publicly available exploit code exists demonstrating this attack path, enabling even moderately skilled attackers to achieve remote code execution and full router compromise for persistence, traffic interception, or pivot attacks into the internal network.