CVE-2026-4975

A vulnerability has been found in Tenda AC15 15.03.05.19. This affects the function formSetCfm of the file /goform/setcfm of the component POST Request Handler. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

• CWE-119
• CWE-121
• CWE-787

• https://lavender-bicycle-a5a.notion.site/Tenda-AC15-setcfm-32153a41781f807b8945dd8920fafc14?source=copy_linkExploit, Third Party Advisory
• https://vuldb.com/?ctiid.353862Permissions Required, VDB Entry
• https://vuldb.com/?id.353862Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.778261Third Party Advisory, VDB Entry
• https://www.tenda.com.cn/Product

Published

Mar 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49741Backend users with write access to the form_definition datab…8.7
• CVE-2026-49742Backend users with file download permissions were able to do…7.1
• CVE-2026-49743Software installed and run as a non-privileged user may cond…7.8
• CVE-2026-49744Kernel software installed and running inside a Guest VM may …7.8
• CVE-2026-49745Kernel software installed and running inside a Guest VM may …7.8
• CVE-2026-49746Software installed and run as a non-privileged user may cond…7.1
• CVE-2026-49753Inconsistent Interpretation of HTTP Requests ('HTTP Request/…6.3
• CVE-2026-49754Allocation of Resources Without Limits or Throttling vulnera…8.2
• CVE-2026-49755Improper Handling of Highly Compressed Data (Data Amplificat…7.5
• CVE-2026-49756Improper Neutralization of CRLF Sequences ('CRLF Injection')…3.7
• CVE-2026-49757Authentication Bypass by Spoofing vulnerability in team-alem…9.2
• CVE-2026-49759Stack-based Buffer Overflow vulnerability in Erlang OTP erts…8.2