CVE-2026-4904
Published: 27 March 2026
Summary
CVE-2026-4904 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac5 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 25.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of the funcpara1 argument in POST requests to /goform/setcfm, directly preventing the stack-based buffer overflow exploitation.
Mandates timely identification, testing, and installation of firmware patches for the known buffer overflow flaw in Tenda AC5 version 15.03.06.47.
Implements memory protections such as stack canaries and address space layout randomization to mitigate stack-based buffer overflow exploits even if the input flaw persists.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in authenticated web form handler (/goform/setcfm) on network device directly enables remote exploitation of a public-facing application (T1190) for arbitrary code execution and full compromise; low-privilege authenticated access to high-impact RCE maps to exploitation for privilege escalation (T1068).
NVD Description
A vulnerability has been found in Tenda AC5 15.03.06.47. This issue affects the function formSetCfm of the file /goform/setcfm of the component POST Request Handler. Such manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack may be…
more
launched remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2026-4904 is a stack-based buffer overflow vulnerability affecting Tenda AC5 routers on firmware version 15.03.06.47. The flaw exists in the formSetCfm function of the /goform/setcfm file within the POST Request Handler component, where manipulation of the funcpara1 argument triggers the overflow.
The vulnerability is exploitable remotely over the network by an attacker with low privileges, such as an authenticated user, requiring low attack complexity and no user interaction. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing arbitrary code execution and full device compromise.
Advisories detail the issue on VulDB (ctiid.353655, id.353655, submit.777381) and a Notion page with exploit information, while the Tenda vendor site is referenced for potential updates. No specific patches are outlined in the available data.
The exploit has been publicly disclosed, heightening the risk for exposed Tenda AC5 devices.
Details
- CWE(s)