A buffer overflow occurs in the Tenda AC5 firmware when the wifiPwd argument of the /goform/setWifi handler is manipulated, allowing attackers to overwrite the stack and execute arbitrary code. The vulnerability is a classic stack-based buffer overflow (CWE-119, CWE-121) that can be triggered remotely via crafted network traffic to the router. Successful exploitation could give the attacker full control over the device, enabling persistence, data exfiltration, or the ability to pivot to other networks. The flaw is known to be exploitable and has been publicly disclosed.

The flaw affects Tenda AC5 routers running firmware version 02.03.01.111_multi. Other firmware releases unpublished may also be vulnerable until a patch is applied. The issue is specific to the Wifi Handler component exposed via the /goform/setWifi endpoint.

The flaw carries a CVSS score of 9.4, indicating critical severity. The EPSS score is not publicly available, but the public disclosure and remote trigger suggest a high likelihood of exploitation. The vulnerability is not yet listed in the CISA KEV catalog. Attackers can reach the vulnerable endpoint from the Internet or a local network as soon as they can communicate with the router’s management interface. No user interaction is required, and the attack can be automated.