CVE-2026-4906 | Tenda AC5 15.03.06.47 POST Request /goform/WizardHandle decodePwd WANT/WANS stack-based overflow

A vulnerability, which was classified as critical, was found in Tenda AC5 15.03.06.47. The affected element is the function decodePwd of the file /goform/WizardHandle of the component POST Request Handler. Executing a manipulation of the argument WANT/WANS can lead to stack-based buffer overflow.

This vulnerability is handled as CVE-2026-4906. The attack can be executed remotely. Additionally, an exploit exists.