Tenda EUVD-2026-16470

Requires authenticated access to Tenda AC5 router (firmware 15.03.06.47) via POST request to /goform/addressNat endpoint. Attacker must be a logged-in user with network access to the router's web interface. No user interaction needed.

This vulnerability presents significant real-world risk despite requiring low-level authentication (PR:L). The CVSS score of 8.8 reflects network accessibility (AV:N), low attack complexity (AC:L), and complete impact across confidentiality, integrity, and availability (C:H/I:H/A:H). Publicly available exploit code exists, as confirmed by the Notion document reference providing detailed exploitation steps, dramatically reducing the skill level required for successful attacks. The exploit maturity indicator (E:P for Proof-of-concept) confirms weaponizable code is circulating. Although no CISA KEV listing indicates widespread active exploitation campaigns, the combination of remote exploitability, authenticated access (which many routers have default or weak credentials), public exploit availability, and complete system compromise potential makes this a genuine priority for organizations using affected Tenda AC5 devices. The attack is automatable once credentials are obtained, and Tenda's consumer router market position means many devices likely have unchanged default passwords, amplifying practical risk beyond the authentication requirement suggest.

An attacker discovers a Tenda AC5 router exposed on the internet or accessible from a compromised internal network. Using credential stuffing with common default passwords (admin/admin) or previously compromised credentials, the attacker authenticates to the web management interface. They then craft a malicious POST request to /goform/addressNat with an oversized 'page' parameter containing shellcode, triggering the stack-based buffer overflow in fromAddressNat. Publicly available exploit code exists to facilitate this attack. The overflow overwrites the return address, redirecting execution to attacker-controlled code that establishes persistent access, modifies DNS settings to redirect traffic, or pivots into the internal network.