The vulnerability is caused by a stack‐based buffer overflow in the Tenda AC5 firmware 15.03.06.47, triggered by manipulating the PPPOEPassword argument of the formQuickIndex function that handles POST requests. The overflow can corrupt the stack, potentially allowing an attacker to execute arbitrary code or otherwise compromise the device. The weakness maps to CWE-119 (improper restriction of operations within bounds) and CWE-121 (stack-based buffer overflow).

The affected product is the Tenda AC5 router running firmware version 15.03.06.47. No other versions are listed in the CNA data, so the risk is confined to this specific build.

The CVSS score of 8.7 indicates high severity, but the EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog, so exact exploitation likelihood is unknown. The description states the attack may be initiated remotely via a crafted POST request, and that an exploit has already been published. Given the high impact and potential remote initiation, the overall risk remains high.