This vulnerability affects Tenda AC5 version 15.03.06.47 and involves a stack-based buffer overflow in the formQuickIndex function of the /goform/QuickIndex POST request handler. The issue arises from improper handling of the PPPOEPassword parameter, allowing an attacker to remotely trigger a buffer overflow condition. The CVSS 4.0 base score is 8.7, reflecting high impact and ease of exploitation without user interaction or elevated privileges. The vulnerability is publicly known and an exploit has been published, but no vendor patch or fix has been documented.

Successful exploitation of this vulnerability could allow a remote attacker to cause a stack-based buffer overflow, potentially leading to arbitrary code execution or denial of service on the affected device. The vulnerability requires only network access and no user interaction, increasing its risk. However, there are currently no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected device's management interface and monitor for unusual activity. Avoid exposing the device's administrative interfaces to untrusted networks.