CVE-2026-4904 in AC5
Summary
by MITRE • 03/27/2026
A vulnerability has been found in Tenda AC5 15.03.06.47. This issue affects the function formSetCfm of the file /goform/setcfm of the component POST Request Handler. Such manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/22/2026
The vulnerability in Tenda AC5 router firmware version 15.03.06.47 represents a critical stack-based buffer overflow flaw within the web interface administration component. This vulnerability exists in the formSetCfm function located in the /goform/setcfm file, which serves as a POST request handler for configuration management operations. The flaw specifically manifests when processing the funcpara1 argument, where insufficient input validation allows attackers to manipulate the parameter in ways that exceed allocated buffer boundaries. The issue's remote exploitability means that malicious actors can trigger this vulnerability without requiring physical access to the device, making it particularly dangerous for networked environments where these routers are deployed.
The technical nature of this vulnerability places it squarely within the realm of CWE-121 Stack-based Buffer Overflow, which occurs when data written to a stack buffer exceeds the buffer's allocated size, potentially overwriting adjacent memory locations including return addresses and function pointers. The attack vector leverages HTTP POST requests sent to the vulnerable endpoint, where the funcpara1 parameter is directly used in memory operations without proper bounds checking. This allows attackers to craft malicious payloads that overwrite the stack frame, potentially leading to arbitrary code execution or complete system compromise. The fact that this exploit has been publicly disclosed significantly increases the risk profile, as it removes the element of surprise that typically protects systems from zero-day attacks.
The operational impact of this vulnerability extends beyond simple privilege escalation or denial of service scenarios. Attackers who successfully exploit this flaw can gain full administrative control over affected Tenda AC5 routers, potentially enabling them to modify network configurations, redirect traffic through malicious proxies, or establish persistent backdoors for future access. The vulnerability affects all devices running the specified firmware version, creating a widespread risk for organizations and individuals who have not yet updated their router firmware. Network administrators face the challenge of identifying potentially compromised devices within their networks, as the attack can occur silently and without generating obvious network anomalies. The remote nature of the exploit means that attackers can target these devices from anywhere on the internet, particularly targeting routers that are exposed to public networks or have default administrative credentials.
Mitigation strategies for this vulnerability require immediate firmware updates from Tenda, as the manufacturer should provide patched versions that properly validate input parameters and implement proper buffer size checks. Network segmentation and firewall rules should be implemented to restrict access to router management interfaces from untrusted networks, while also ensuring that default credentials are changed immediately upon device deployment. Security monitoring should include detection of unusual POST requests to the /goform/setcfm endpoint, as well as network traffic analysis for patterns consistent with buffer overflow exploitation attempts. Organizations should also consider implementing network access controls that limit which systems can communicate with router management interfaces, and establish procedures for regularly auditing and updating network device firmware to address known vulnerabilities. The vulnerability's classification under ATT&CK technique T1059.007 for command and script interpreter indicates that successful exploitation could enable attackers to execute arbitrary commands on the affected system, further emphasizing the need for comprehensive defensive measures.