The flaw is a stack-based buffer overflow in the QuickIndex form handler of the Tenda AC5 firmware. An attacker can trigger the overflow by sending a POST request to /goform/QuickIndex with an unusually long PPPOEPassword argument. The vulnerability is classified under CWE‑119, CWE‑121, and CWE‑787. The overflow can overwrite stack data, which may allow control‑flow hijacking or arbitrary code execution. However, the available information does not confirm that code execution is definitely possible; the impact described is a potential consequence based on the type of overflow.

Tenda AC5 routers running firmware version 15.03.06.47 are confirmed to be affected. The firmware CPE list also indicates a generic ac5_firmware entry, suggesting that other firmware releases containing the same formQuickIndex implementation could be vulnerable, though no further versions are explicitly listed.

The CVSS score of 8.7 classifies this as a high‑severity vulnerability. The EPSS score of 5% indicates a moderate probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The exploit is publicly available and requires no authentication, implying that a remote attacker could potentially compromise the device if exploitation is feasible. The likely attack vector is remote via the web interface and is inferred from the description of the POST request handler.