This vulnerability in Tenda AC5 firmware 15.03.06.47 involves a stack-based buffer overflow triggered by manipulating the 'page' argument in the fromAddressNat function of the /goform/addressNat POST request handler. The flaw allows remote attackers to overflow the stack, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Exploits are publicly known, increasing the risk of exploitation.

Successful exploitation can lead to a stack-based buffer overflow, which may allow remote attackers to execute arbitrary code or cause denial of service on affected Tenda AC5 devices. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk profile. The presence of public exploits further elevates the threat.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided, users should monitor Tenda's official channels for updates. In the meantime, restricting network access to the device's management interface and disabling remote management features, if possible, may reduce exposure.