CVE-2026-5830
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
In Tenda AC15 version 15.03.05.18, the function websGetVar in /goform/SysToolChangePwd is vulnerable to stack-based buffer overflow via manipulation of arguments oldPwd/newPwd/cfmPwd. The attack can be executed remotely, and the exploit is publicly available.
Risk Assessment
An attacker can remotely take control of the device or cause a crash, posing a serious risk to network security.
Recommendation
Immediately update the Tenda AC15 firmware to the latest available version.
Other vulnerabilities in Tenda AC15
See all- CVE-2026-11493Medium
A weakness was identified in Tenda AC15 firmware version 15.03.05.19 in the Samba component. Manipulation of the /etc_ro/smb.conf file leads to weak password requirements. The attack is only possible within the local network, has high complexity, and is difficult to exploit, but the exploit is publicly available.
- CVE-2025-55564High
A stack overflow vulnerability exists in the Tenda AC15 router firmware version 15.03.05.19_multi_TD01 in the fromSetIpMacBind function via the list parameter. An attacker can remotely crash the device or potentially execute arbitrary code.
Original NVD description (English source)
A vulnerability was identified in Tenda AC15 15.03.05.18. This affects the function websGetVar of the file /goform/SysToolChangePwd. Such manipulation of the argument oldPwd/newPwd/cfmPwd leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.