Which versions of Tenda are affected by CVE-2026-4975?

CVE-2026-4975 is a stack-based buffer overflow in Tenda AC15 router firmware (version 15.03.05.19) that allows authenticated attackers to execute arbitrary code on affected devices.

How to fix or mitigate CVE-2026-4975?

Within 24 hours: Identify all Tenda AC15 routers in your environment running firmware 15.03.05.19 using network scanning tools; restrict administrative access to the device management interface via network segmentation. Within 7 days: Contact Tenda for available firmware updates (check for versions >15.03.05.19); implement network-level authentication controls to limit access to /goform/setcfm endpoints. Within 30 days: Deploy updated firmware immediately upon vendor release; if no patch becomes available, evaluate replacing affected devices with alternative router hardware from vendors with active security support.

Tenda CVE-2026-4975

Q: What is the CVSS score of CVE-2026-4975?

CVE-2026-4975 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16811 HIGH

Buffer Overflow (CWE-119)

2026-03-27 cna@vuldb.com

Tenda Buffer Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 27, 2026 - 20:22 euvd

EUVD-2026-16811

Analysis Generated

Mar 27, 2026 - 20:22 vuln.today

CVE Published

Mar 27, 2026 - 20:16 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability has been found in Tenda AC15 15.03.05.19. This affects the function formSetCfm of the file /goform/setcfm of the component POST Request Handler. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Stack-based buffer overflow in Tenda AC15 router firmware 15.03.05.19 enables remote authenticated attackers to achieve code execution via the formSetCfm function. The vulnerability is triggered through POST requests to /goform/setcfm by manipulating the funcpara1 parameter. A publicly available exploit code exists, significantly lowering the barrier to exploitation for attackers with low-privilege credentials.

Technical ContextAI

This vulnerability affects the formSetCfm function within the POST request handler of Tenda AC15 wireless router firmware version 15.03.05.19. The flaw is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), manifesting specifically as a stack-based buffer overflow. When processing POST requests to the /goform/setcfm endpoint, the application fails to properly validate the length of the funcpara1 parameter before copying it to a fixed-size stack buffer. This classic memory corruption vulnerability allows attacker-controlled data to overflow the allocated buffer and overwrite adjacent memory regions on the stack, including return addresses and saved frame pointers. In embedded router firmware like Tenda AC15, such overflows can lead to control flow hijacking and arbitrary code execution within the context of the web server process, which typically runs with elevated privileges.

RemediationAI

Users should immediately check for firmware updates from Tenda's official website at https://www.tenda.com.cn/ and apply the latest available firmware version for the AC15 model. No vendor-released patch identified at time of analysis from the provided data. Until a patched firmware version is available and applied, implement the following risk mitigation measures: disable remote management access to the router's web interface, restrict administrative access to trusted internal IP addresses only through the router's access control settings, change default administrative credentials to strong unique passwords (minimum 16 characters with mixed case, numbers, and symbols), enable firewall rules to block external access to management ports, and segment the network to isolate the router's management interface from untrusted zones. Organizations should also monitor for unusual configuration changes or administrative access patterns. Consider replacing affected devices with alternative router models if Tenda does not provide a security update within a reasonable timeframe, particularly for networks handling sensitive data.