Which versions of Tenda are affected by CVE-2026-5830?

Tenda AC15 routers running firmware 15.03.05.18 contain a stack buffer overflow in the password change function that allows authenticated users to execute arbitrary code with full system compromise.

Is there a public PoC exploit available for CVE-2026-5830?

Yes, a public proof-of-concept exploit is available for CVE-2026-5830. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5830?

Within 24 hours: Inventory all Tenda AC15 routers in production and identify firmware versions via administrative interface. Within 7 days: Restrict administrative access to AC15 routers to a limited security team; disable remote management if not operationally required; rotate all router credentials and enforce strong passwords. Within 30 days: Contact Tenda for patch availability timeline; evaluate replacement with patched alternative or vendor models with confirmed security updates; implement network segmentation to limit blast radius if compromise occurs.

Tenda CVE-2026-5830

Q: What is the CVSS score of CVE-2026-5830?

CVE-2026-5830 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-20828 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-09 VulDB

Tenda Buffer Overflow Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 09, 2026 - 02:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 02:15 euvd

EUVD-2026-20828

Analysis Generated

Apr 09, 2026 - 02:15 vuln.today

CVE Published

Apr 09, 2026 - 01:30 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was identified in Tenda AC15 15.03.05.18. This affects the function websGetVar of the file /goform/SysToolChangePwd. Such manipulation of the argument oldPwd/newPwd/cfmPwd leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.

AnalysisAI

Stack-based buffer overflow in Tenda AC15 router firmware 15.03.05.18 websGetVar function allows authenticated remote attackers to execute arbitrary code with high impact to confidentiality, integrity, and availability. The vulnerability resides in /goform/SysToolChangePwd endpoint where manipulation of oldPwd, newPwd, or cfmPwd parameters triggers memory corruption. Publicly available exploit code exists. Exploitation requires low-privilege authenticated access but no user interaction, making it readily exploitable once credentials are obtained.

Technical ContextAI

Stack buffer overflow (CWE-121) in websGetVar function processing password change parameters. Insufficient input validation on oldPwd/newPwd/cfmPwd arguments permits oversized data to corrupt stack memory. Attack vector is network-accessible (AV:N) with low complexity (AC:L), requiring only authenticated low-privilege access (PR:L). Root cause is unbounded string copy operation in embedded web server password management routine.

RemediationAI

No vendor-released patch identified at time of analysis. Tenda has not published security advisories addressing CVE-2026-5830 per https://www.tenda.com.cn/. Recommended immediate actions: restrict administrative interface access to trusted management networks only via firewall rules, disable remote administration features, implement strong unique credentials, monitor for unauthorized password change attempts in device logs. Consider replacement with actively maintained router firmware if vendor does not issue timely patch. Consult VulDB advisory https://vuldb.com/vuln/356277 and threat intelligence https://vuldb.com/vuln/356277/cti for updates. Organizations should evaluate device retirement if patch unavailable within acceptable risk timeframe given confirmed exploit availability.