{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ac5-02.03.01.111_multi/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:tenda:ac5:02.03.01.111_multi:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-105778"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AC5 (02.03.01.111_multi)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["Tenda"],"content_html":"\u003cp\u003eA critical stack-based buffer overflow vulnerability has been identified in Tenda AC5 router firmware version 02.03.01.111_multi. The flaw is located within the Wifi Handler component, specifically within the '/goform/setWifi' endpoint. An unauthenticated remote attacker can trigger this vulnerability by sending a maliciously crafted 'wifiPwd' argument to the device. Exploitation of this flaw allows for arbitrary code execution or a denial of service condition. Given that the exploit code has been disclosed to the public, there is a high risk of active exploitation. Defenders should monitor for unexpected traffic directed at the router's web management interface and evaluate exposure of these devices.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability results in full device compromise, allowing an attacker to execute arbitrary code with the privileges of the web management process. This can lead to persistent unauthorized access, lateral movement within the local network, or persistent denial of service. The vulnerability is rated at a CVSS v3.1 base score of 9.9, reflecting its critical nature and ease of remote exploitation without authentication.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all Tenda AC5 devices within the environment, specifically those running firmware version 02.03.01.111_multi.\u003c/li\u003e\n\u003cli\u003eImplement access control lists (ACLs) on the perimeter firewall to restrict access to the web management interface of identified Tenda devices from untrusted networks.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic logs for anomalous HTTP POST requests directed at '/goform/setWifi'.\u003c/li\u003e\n\u003cli\u003eMonitor for firmware update availability from Tenda and apply patches to all vulnerable AC5 devices as soon as they are released.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-06T08:53:33Z","date_published":"2026-10-06T08:53:33Z","id":"https://feed.craftedsignal.io/briefs/2026-10-tenda-ac5-overflow/","summary":"A critical remote stack-based buffer overflow vulnerability in the Tenda AC5 router allows unauthenticated attackers to execute arbitrary code via the wifiPwd parameter.","title":"Remote Stack-Based Buffer Overflow in Tenda AC5","url":"https://feed.craftedsignal.io/briefs/2026-10-tenda-ac5-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - AC5 (02.03.01.111_multi)","version":"https://jsonfeed.org/version/1.1"}