CVE-2026-4975
Published: 27 March 2026
Summary
CVE-2026-4975 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac15 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely identification, reporting, and correction of flaws like the stack-based buffer overflow in Tenda AC15's formSetCfm function.
SI-10 enforces validation of inputs such as the funcpara1 argument in POST requests to /goform/setcfm to prevent buffer overflows.
SI-16 implements memory safeguards like stack canaries and non-executable stacks to block code execution from the stack-based buffer overflow.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the router's web POST handler (/goform/setcfm) enables remote code execution from a low-privileged network session, directly mapping to exploitation of a public-facing application (T1190) and privilege escalation to achieve full system impact (T1068).
NVD Description
A vulnerability has been found in Tenda AC15 15.03.05.19. This affects the function formSetCfm of the file /goform/setcfm of the component POST Request Handler. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack can be initiated…
more
remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2026-4975 is a stack-based buffer overflow vulnerability in Tenda AC15 firmware version 15.03.05.19. It affects the formSetCfm function in the /goform/setcfm file of the POST Request Handler component, where manipulation of the funcpara1 argument triggers the overflow. Published on 2026-03-27, the issue is rated 8.8 on the CVSS 3.1 scale (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWEs 119, 121, and 787.
The vulnerability enables remote exploitation over the network with low attack complexity, requiring only low privileges and no user interaction. An attacker with network access and minimal authentication can manipulate the funcpara1 argument via a POST request, potentially achieving high impacts on confidentiality, integrity, and availability, such as remote code execution.
VulDB advisories detail the issue and note that the exploit has been publicly disclosed via a Notion page and may be actively used. No specific patches are mentioned in the provided details; security practitioners should consult the vendor site at tenda.com.cn and VulDB references (ctiid.353862, id.353862, submit.778261) for mitigation guidance or firmware updates.
Details
- CWE(s)