Ac5
Monthly
Stack-based buffer overflow in the Tenda AC5 router's web management interface allows an authenticated remote attacker to corrupt memory and potentially execute code by submitting an oversized wifiPwd argument to /goform/setWifi on firmware 02.03.01.111_multi. Exploitation requires network reachability to the device's HTTP management interface plus a valid low-privilege administrative session (CVSS vector PR:L), meaning fully unauthenticated attackers cannot trigger it against a hardened default configuration unless the management port is openly exposed. Publicly available exploit code exists (a detailed write-up has been published on GitHub), and the vulnerability carries a CVSS 4.0 base score of 8.6 with high confidentiality, integrity and availability impact; there is no CISA KEV listing indicating confirmed active exploitation, and no vendor patch has been identified from the available references.
Stack-based buffer overflow in the Tenda AC5 router's web management interface allows an authenticated remote attacker to corrupt memory and potentially execute code by submitting an oversized wifiPwd argument to /goform/setWifi on firmware 02.03.01.111_multi. Exploitation requires network reachability to the device's HTTP management interface plus a valid low-privilege administrative session (CVSS vector PR:L), meaning fully unauthenticated attackers cannot trigger it against a hardened default configuration unless the management port is openly exposed. Publicly available exploit code exists (a detailed write-up has been published on GitHub), and the vulnerability carries a CVSS 4.0 base score of 8.6 with high confidentiality, integrity and availability impact; there is no CISA KEV listing indicating confirmed active exploitation, and no vendor patch has been identified from the available references.