Tenda AC15 SysToolChangePwd websGetVar stack-based overflow

Successful exploitation of CVE-2026-5830 allows an attacker to cause a denial-of-service (DoS) condition on the Tenda AC15 router. The stack-based buffer overflow can lead to a crash, effectively rendering the router unresponsive. Given the router's role in network connectivity and security, this disruption can impact all devices relying on it for internet access. The availability of a public exploit significantly increases the likelihood of widespread exploitation, potentially affecting numerous home and small business networks. The remote nature of the vulnerability means attackers do not need physical access to the router to exploit it.

Home and small business users who rely on Tenda AC15 routers running the vulnerable firmware version 15.03.05.18 are at significant risk. This includes users with basic network configurations and those who have not implemented strong firewall rules. Shared hosting environments utilizing Tenda AC15 routers are also potentially vulnerable.

• linux / server:

journalctl -u tenda -g 'SysToolChangePwd'

• generic web:

curl -I http://<router_ip>/goform/SysToolChangePwd | grep -i '200 OK'

1. 2026-04-09Disclosure

   disclosure

1. Reservado2026-04-08
2. Publicada2026-04-09
3. EPSS atualizado2026-04-16

The primary mitigation for CVE-2026-5830 is to upgrade the Tenda AC15 router to a firmware version that addresses the buffer overflow vulnerability. Unfortunately, a fixed firmware version is not specified in the provided data. As a temporary workaround, consider implementing strict firewall rules to restrict access to the /goform/SysToolChangePwd endpoint from untrusted sources. Monitor router logs for unusual activity, particularly related to password changes. While not a direct fix, enabling router logging can aid in post-incident analysis and detection of exploitation attempts. After applying any mitigation, verify the router's stability and functionality by attempting a password reset through the web interface.