Tenda AC5 routers exhibit a stack‑based buffer overflow in the formQuickIndex handler of the /goform/QuickIndex POST request. By sending a specially crafted PPPOEPassword value, an attacker can overflow the buffer. The CVE description notes that the flaw has an existing exploit and can be triggered remotely; the overflow may enable arbitrary code execution or compromise the router’s firmware, an inference drawn from the nature of stack overflows but not explicitly stated in the CVE data.

The vulnerability affects Tenda AC5 units running firmware version 15.03.06.47 and potentially other AC5 releases indicated by the provided CPE entries. Devices that expose the QuickIndex POST handler to external traffic without authentication are susceptible; exact version coverage is known only for 15.03.06.47, while other builds may be impacted as well.

The CVSS score of 8.7 classifies this flaw as high severity, and the EPSS score of less than 1% suggests a currently low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the exploit is publicly available and requires no special credentials, the impact to confidentiality and integrity of the router is significant, potentially allowing a remote attacker to gain control of the device.