CVE-2026-4902: Buffer Overflow in Tenda AC5 Firmware

The buffer overflow vulnerability in Tenda AC5 Firmware allows a remote attacker to execute arbitrary code on the device. This means an attacker could potentially gain complete control over the router, including access to its configuration, network traffic, and connected devices. The ability to remotely execute code makes this a high-impact vulnerability, enabling attackers to perform actions such as modifying firewall rules, intercepting sensitive data, launching attacks against internal network resources, or even using the router as a bot in a distributed denial-of-service (DDoS) attack. The availability of a public exploit significantly lowers the barrier to entry for malicious actors.

1. Reserved2026-03-26
2. Published2026-03-26
3. Modified2026-03-27
4. EPSS updated2026-04-03

The primary mitigation for CVE-2026-4902 is to upgrade to a patched version of Tenda AC5 Firmware as soon as it becomes available from Tenda. Until a patch is released, consider implementing temporary workarounds such as restricting access to the /goform/addressNat endpoint using a firewall or access control list (ACL). Monitor network traffic for suspicious activity targeting this endpoint. While a direct detection signature is difficult to create without specific exploit patterns, monitor system logs for unusual memory access patterns or crashes related to the router's web interface. After upgrading, confirm the vulnerability is resolved by attempting to trigger the overflow (carefully, in a controlled environment) and verifying that the router does not crash or exhibit unexpected behavior.