CVE-2026-4903

A flaw has been found in Tenda AC5 15.03.06.47. This vulnerability affects the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. This manipulation of the argument PPPOEPassword causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been published and may be used.

• CWE-119
• CWE-121
• CWE-787

• https://lavender-bicycle-a5a.notion.site/Tenda_AC5_QuickIndex_PPPOEPassword-32053a41781f808dae98f99c99bcb21c?source=copy_linkExploit, Third Party Advisory
• https://vuldb.com/?ctiid.353654Permissions Required, VDB Entry
• https://vuldb.com/?id.353654Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.777380Third Party Advisory, VDB Entry
• https://www.tenda.com.cn/Product

Published

Mar 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49008By accessing unencrypted information in the device firmware,…6.5
• CVE-2026-49009Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fi…3.1
• CVE-2026-4901AlanWeb SCADA saves sensitive information into a log file. C…6.5
• CVE-2026-49014In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in t…7.8
• CVE-2026-49017In OpenStack Swift before 2.36.2 and 2.37.2, s3api middlewar…6.5
• CVE-2026-4902A vulnerability was detected in Tenda AC5 15.03.06.47. This …8.8
• CVE-2026-49030Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2026-49033The application contains a stack-based buffer overflow vulne…8.4
• CVE-2026-49035The affected product is vulnerable to a heap-based buffer ov…9.2
• CVE-2026-4904A vulnerability has been found in Tenda AC5 15.03.06.47. Thi…8.8
• CVE-2026-49042Improper Input Validation vulnerability in Apache Camel. Th…7.3
• CVE-2026-49043Unauthenticated Cross Site Request Forgery (CSRF) in WP Migr…4.7