The vulnerability CVE-2026-4906 affects Tenda AC5 version 15.03.06.47. It is a stack-based buffer overflow in the decodePwd function of the /goform/WizardHandle component, triggered by crafted POST requests manipulating the WANT/WANS argument. This flaw allows remote attackers to cause memory corruption, which could lead to denial of service or potentially arbitrary code execution. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The exploit has been publicly disclosed, but no known exploits in the wild have been reported. No official patch or vendor advisory is currently referenced.

Successful exploitation of this vulnerability can lead to a stack-based buffer overflow, which may allow an attacker to crash the device or execute arbitrary code remotely. This compromises the confidentiality, integrity, and availability of the affected device. Given the network attack vector and no required privileges, the risk to exposed devices is significant. However, no confirmed active exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the affected device's management interface from untrusted networks and monitor for unusual activity. Avoid exposing the device's administrative interfaces directly to the internet. Follow vendor channels for updates regarding patches or official mitigations.