The Tenda AC5 router firmware version 15.03.06.47 contains a stack-based buffer overflow vulnerability in the formWifiWpsOOB function of the /goform/WifiWpsOOB POST Request Handler. By manipulating the 'index' argument in a POST request, an attacker can overflow a buffer on the stack, potentially leading to remote code execution or service disruption. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The exploit code has been made public, increasing the risk of exploitation. No official patch or mitigation details have been provided by Tenda as of the publication date.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on affected Tenda AC5 devices running firmware version 15.03.06.47. This can compromise the device's integrity and availability, potentially allowing attackers to control the router or disrupt network connectivity. The vulnerability is exploitable remotely without user interaction and requires no privileges, increasing the risk profile.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, such as disabling remote management features or restricting access to trusted networks. Monitor vendor channels for updates and apply firmware updates promptly once available.