Loading story…
Two high-severity vulnerabilities have been disclosed in Tenda router firmware, affecting Tenda AC5 version 15.03.06.47 and Tenda AC6 version 15.03.05.16. The flaws reside in the formQuickIndex function behind the /goform/QuickIndex POST request handler, where improper handling of the PPPOEPassword parameter can trigger a stack-based buffer overflow. Both issues are tracked as CVE-2026-4903 for AC5 and CVE-2026-4961 for AC6.
The vulnerabilities are described as remotely exploitable, with public exploits available, raising the risk of real-world attacks against exposed devices. The entries map the weaknesses to CWE-119 and CWE-121, and their published CVSS vectors indicate high impact across confidentiality, integrity, and availability, making these flaws significant for organizations or users still operating the affected firmware.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A separate CVE entry was recorded for Tenda AC6 firmware 15.03.05.16 involving a stack-based buffer overflow in the same formQuickIndex function of the /goform/QuickIndex POST handler through the PPPOEPassword argument. The vulnerability was described as remotely exploitable with a public exploit available and classified under CWE-119 and CWE-121.
A CVE entry for Tenda AC5 firmware 15.03.06.47 was recorded describing a stack-based buffer overflow in the formQuickIndex function of the /goform/QuickIndex POST handler via the PPPOEPassword argument. The flaw was noted as remotely exploitable, with a public exploit available, and mapped to CWE-119 and CWE-121.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities have been disclosed in **Tenda AC15** router firmware, both involving stack-based buffer overflows in web management handlers that are reachable through crafted POST requests. **CVE-2026-4975** affects firmware version `15.03.05.19` in the `formSetCfm` function behind the `/goform/setcfm` endpoint, where manipulation of the `funcpara1` parameter can corrupt memory and potentially allow remote compromise of the device. A second flaw, **CVE-2026-5830**, affects Tenda AC15 version `15.03.05.18` in the `websGetVar` function used by `/goform/SysToolChangePwd`; crafted `oldPwd`, `newPwd`, or `cfmPwd` values can trigger another stack-based overflow. Both issues are classified under **`CWE-119`** and **`CWE-121`**, carry high-impact severity ratings for confidentiality, integrity, and availability, and have been publicly disclosed, with the latter report explicitly noting that a public exploit is available.
Jun 29, 2026
Two high-severity vulnerabilities have been disclosed in Tenda router firmware, affecting **FH451 1.0.0.9** and **F453 1.0.0.3**. The flaws are tracked as `CVE-2026-4534` and `CVE-2026-4552` and both involve remotely reachable stack-based buffer overflows in web management handlers. In the FH451 case, the issue is in the `formWrlExtraSet` function exposed through the `/goform/WrlExtraSet` component, where manipulation of the `GO` argument can trigger memory corruption. In the F453 case, the vulnerable code is the `fromVirtualSer` function behind the `/goform/VirtualSer` endpoint, where the `page` argument can be abused to cause a similar overflow. Both CVE records indicate that **public exploits are available**, increasing the likelihood of opportunistic attacks against exposed devices. The disclosures map the weaknesses to `CWE-119` and `CWE-121`, reflecting out-of-bounds memory handling and stack-based buffer overflow conditions, and the published scoring points to high impact on confidentiality, integrity, and availability. Organizations using these Tenda models should treat the flaws as urgent remote compromise risks, especially where router administration interfaces are internet-accessible.
Jun 29, 2026
Several high-severity vulnerabilities have been disclosed in the **Tenda F456** router running firmware `1.0.0.5`, affecting the device’s `httpd` component across multiple `/goform/` endpoints. The flaws include `CVE-2026-7053` in `frmL7ProtForm` via `/goform/L7Prot`, `CVE-2026-7055` in `fromVirtualSer` via `/goform/VirtualSer`, `CVE-2026-7056` in `fromSafeUrlFilter` via `/goform/SafeUrlFilter`, and `CVE-2026-7057` in `/goform/setcfm`. In each case, crafted input to parameters such as `page`, `menufacturer`, `Go`, `funcname`, or `funcpara1` can trigger a buffer overflow. The vulnerabilities are described as **remotely exploitable** and have been mapped to `CWE-119` and `CWE-120`, with CVSS scoring indicating high impact to confidentiality, integrity, and availability. Public exploit code has also been reported for all four issues, including references to VulDB and GitHub proof-of-concept material, raising the risk of active attacks against exposed devices. Organizations using affected Tenda F456 routers should treat the flaws as urgent exposure in internet-facing network infrastructure.
Jun 29, 2026