CVE-2026-4905

A vulnerability was found in Tenda AC5 15.03.06.47. Impacted is the function formWifiWpsOOB of the file /goform/WifiWpsOOB of the component POST Request Handler. Performing a manipulation of the argument index results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

• CWE-119
• CWE-121
• CWE-787

• https://lavender-bicycle-a5a.notion.site/Tenda_AC5_WifiWpsOOB_index-32053a41781f8096a9b6e48177c25eb0?source=copy_linkExploit, Third Party Advisory
• https://vuldb.com/?ctiid.353656Permissions Required, VDB Entry
• https://vuldb.com/?id.353656Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.777393Third Party Advisory, VDB Entry
• https://www.tenda.com.cn/Product

Published

Mar 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49044Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-49045Missing Authorization vulnerability in WP Media Adminimize a…4.3
• CVE-2026-49046Improper Neutralization of Special Elements used in an SQL C…8.5
• CVE-2026-49047Missing Authorization vulnerability in DearHive DearFlip all…4.3
• CVE-2026-49048The Joomla extension JoomCCK exposes a front-end controller …9.8
• CVE-2026-49049The Helix3 plugin for Joomla exposes an ajax handler task, t…7.5
• CVE-2026-49050General user can mint admin access tokens via /access-tokens…8.8
• CVE-2026-49051Missing Authorization vulnerability in Prasad Kirpekar WP Me…4.3
• CVE-2026-49052Missing Authorization vulnerability in Wpmet ElementsKit Ele…4.3
• CVE-2026-49053Missing Authorization vulnerability in Wpmet ElementsKit Ele…5.3
• CVE-2026-49054Missing Authorization vulnerability in Mamunur Rashid The Po…4.3
• CVE-2026-49055Unauthenticated Cross Site Scripting (XSS) in Drag and Drop …7.1