Tenda EUVD-2026-16476

Tenda AC5 firmware version 15.03.06.47. Attacker requires authenticated access with login credentials to send a POST request to /goform/WifiWpsOOB with a malicious index argument, triggering stack-based buffer overflow.

This vulnerability presents significant real-world risk based on multiple converging signals. The CVSS 8.8 score reflects network-accessible attack vector (AV:N) with low complexity (AC:L) requiring only low-privilege authentication (PR:L) and no user interaction (UI:N), resulting in high impact across all CIA triad components. Critically, publicly available exploit code exists (documented in the Notion reference), substantially lowering the barrier to exploitation and enabling adversaries without specialized reverse-engineering skills to weaponize the flaw. The authentication requirement (PR:L) provides minimal protection since many Tenda devices ship with default credentials or weak passwords commonly exploited in IoT botnets. The vulnerability's technical impact enables complete device compromise, potentially allowing attackers to pivot into internal networks, modify routing configurations, intercept traffic, or recruit devices into DDoS botnets. The combination of public exploit availability, network accessibility, and widespread deployment of consumer routers elevates this beyond a theoretical risk to an actionable threat requiring urgent remediation priority.

An attacker on the internet identifies a Tenda AC5 router with exposed administrative interface and either brute-forces weak credentials or uses default passwords to authenticate with low privileges. Using the publicly available exploit code documented in the Notion reference, the attacker sends a crafted POST request to /goform/WifiWpsOOB with a malicious 'index' parameter containing shellcode and buffer overflow payload. The stack corruption overwrites the return address, redirecting execution to attacker-controlled code that establishes persistent backdoor access, modifies DNS settings to redirect traffic, or enlists the device in a botnet for subsequent attacks.