Ac6 CVE-2026-4961

Requires authenticated access to Tenda AC6 router version 15.03.05.16. Attacker must send a POST request to /goform/QuickIndex with a malicious PPPOEPassword parameter exceeding buffer limits. No user interaction needed.

This vulnerability presents high real-world risk based on convergent risk signals. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-based exploitation with low attack complexity requiring only low-privileged authentication, achieving full system compromise. The Environmental metrics (E:P) confirm proof-of-concept exploit code exists, and references include a public Notion document with detailed exploitation steps. While no EPSS score is provided in the data and CISA KEV status is not indicated, the combination of public exploit availability, router/IoT target profile (often unpatched), network accessibility, and complete impact across confidentiality, integrity, and availability elevates practical risk. Consumer routers are high-value targets for botnet recruitment and network pivoting. The authentication requirement (PR:L) provides minimal barrier as many Tenda devices ship with default credentials or weak passwords. This is a real priority requiring immediate attention for organizations using affected hardware.

An attacker on the same network or with internet access to an exposed router management interface first authenticates using default, leaked, or brute-forced credentials (satisfying the PR:L requirement). The attacker then crafts a malicious POST request to /goform/QuickIndex with an oversized PPPOEPassword parameter designed to overflow the stack buffer and overwrite the return address with shellcode location. Upon function return, execution jumps to attacker-controlled code, granting full router compromise with the ability to intercept traffic, pivot to internal networks, or recruit the device into a botnet. Publicly available exploit code exists demonstrating this attack path.