Tenda EUVD-2026-16474

Tenda AC5 firmware version 15.03.06.47. Attacker requires authenticated access to the device (low-privilege user credentials). Remote exploitation via POST request to /goform/setcfm endpoint with malicious funcpara1 parameter causes stack-based buffer overflow.

This vulnerability presents a high real-world risk despite requiring low-privilege authentication (PR:L). The CVSS base score of 8.8 reflects network-accessible exploitation (AV:N), low attack complexity (AC:L), no user interaction required (UI:N), and high impact across all CIA triad dimensions (C:H/I:H/A:H). The existence of publicly available exploit code significantly elevates the threat, as documented exploits with detailed technical walkthroughs are accessible via multiple references including a Notion document with proof-of-concept details. The E:P (Proof-of-Concept) temporal metric confirms exploit code exists. While EPSS data is not provided in the input, the combination of public exploit availability, network attack vector, low complexity, and consumer router deployment context suggests active scanning and exploitation attempts are probable. No CISA KEV inclusion is indicated, so widespread active exploitation is not confirmed, but the low barrier to entry (authenticated access to router admin interfaces is commonly achievable via credential stuffing, default passwords, or social engineering) makes this a priority for organizations and home users running affected Tenda AC5 devices.

An attacker who has obtained low-privilege credentials to the Tenda AC5 web administration interface (through default passwords, credential reuse, or prior compromise) crafts a malicious POST request to the /goform/setcfm endpoint with an oversized funcpara1 parameter designed to overflow the stack buffer in the formSetCfm function. Publicly available exploit code exists that demonstrates successful exploitation techniques, allowing the attacker to overwrite return addresses and execute arbitrary code with router firmware privileges. Upon successful exploitation, the attacker gains complete control of the router, enabling network traffic interception, DNS hijacking, persistent backdoor installation, or use of the device as a pivot point into the connected LAN.