Tenda AC5 firmware version 15.03.06.47 contains a stack-based buffer overflow in the decodePwd function, located in the /goform/WizardHandle POST request handler. An attacker can send a specially crafted POST request containing a manipulated WANT/WANS argument, causing the overflow and potentially allowing arbitrary code execution on the device. The vulnerability is a classic stack corruption flaw commonly linked to CWEs 119, 121, and 787.

The flaw affects Tenda AC5 routers, specifically firmware revision 15.03.06.47. The vulnerable endpoint is /goform/WizardHandle, which processes HTTP POST requests from clients authorized to manage the device. Devices running earlier firmware builds may be affected until a patch is applied.

The CVSS score of 8.7 indicates high severity, and the EPSS score of less than 1% suggests low overall exploitation probability, though the vulnerability has been publicly disclosed and could be leveraged by well‑equipped adversaries. The attack vector is remote, requiring network access to the router’s management interface to execute the malicious POST request. No CISA KEV listing is present, but the presence of a stack overflow and remote trigger warrants respect for potential exploitation.