A stack‑based buffer overflow exists in the Tenda AC5 router firmware 15.03.06.47. The flaw is triggered by manipulating the index argument within the formWifiWpsOOB function that processes POST requests to the /goform/WifiWpsOOB endpoint. The overflow corrupts the stack and allows an attacker to execute arbitrary code, potentially giving full control over the device. The weakness is classified as a stack buffer overflow (CWE‑119) and stack corruption (CWE‑121).

The affected device is the Tenda AC5 router running firmware version 15.03.06.47. Earlier or identical builds that have not applied the fix are likely vulnerable as well. No other vendors or products are listed as impacted.

The CVSS base score of 8.7 indicates a high severity vulnerability. While EPSS data is not available, a publicly available exploit demonstrates that the flaw can be practically exploited. The most probable attack vector is a crafted HTTP POST request to /goform/WifiWpsOOB sent from an external network. Successful exploitation results in arbitrary code execution on the router, compromising confidentiality, integrity, and availability of all devices behind the router. The vulnerability is not listed in the CISA KEV catalog, but its public exploitation makes it a significant immediate threat.