Tenda AC5 Router - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/tenda-ac5-router/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 02 Jan 2024 12:00:00 +0000Tenda AC5 Router Stack-Based Buffer Overflow (CVE-2026-4904)https://feed.craftedsignal.io/briefs/2024-01-tenda-ac5-overflow/Tue, 02 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-tenda-ac5-overflow/A stack-based buffer overflow vulnerability (CVE-2026-4904) exists in the Tenda AC5 router version 15.03.06.47, allowing remote attackers to execute arbitrary code by manipulating the 'funcpara1' argument in the '/goform/setcfm' endpoint.A critical stack-based buffer overflow vulnerability, identified as CVE-2026-4904, has been discovered in Tenda AC5 router firmware version 15.03.06.47. The vulnerability resides in the formSetCfm function within the /goform/setcfm endpoint, specifically affecting the POST request handler. This flaw allows a remote, unauthenticated attacker to potentially execute arbitrary code on the device by sending a crafted POST request with a malicious value for the funcpara1 argument. Given the ease of exploitation and the potential for complete system compromise, this vulnerability poses a significant risk to affected devices. Public disclosure of the exploit code increases the likelihood of widespread exploitation.

Attack Chain

  1. The attacker identifies a vulnerable Tenda AC5 router running firmware version 15.03.06.47.
  2. The attacker crafts a malicious HTTP POST request targeting the /goform/setcfm endpoint.
  3. Within the POST request, the attacker includes the funcpara1 argument with a string exceeding the expected buffer size.
  4. The Tenda AC5 router receives the crafted POST request and passes the funcpara1 argument to the formSetCfm function.
  5. Due to insufficient bounds checking, the oversized funcpara1 string overflows the allocated buffer on the stack.
  6. The buffer overflow overwrites adjacent memory on the stack, including the return address.
  7. The attacker carefully crafts the overflow to overwrite the return address with an address pointing to malicious code or a return-oriented programming (ROP) chain.
  8. When the formSetCfm function returns, execution jumps to the attacker-controlled address, resulting in arbitrary code execution on the router.

Impact

Successful exploitation of CVE-2026-4904 grants the attacker complete control over the Tenda AC5 router. This can lead to a variety of malicious activities, including but not limited to: complete device takeover, denial of service, network traffic interception, DNS hijacking, and the installation of persistent backdoors. Given the widespread use of Tenda routers in homes and small businesses, a large number of devices are potentially vulnerable.

Recommendation

  • Deploy the Sigma rule Detect Tenda AC5 Buffer Overflow Attempt to identify exploitation attempts against the vulnerable /goform/setcfm endpoint.
  • Apply any available patches or firmware updates released by Tenda to address CVE-2026-4904.
  • Monitor web server logs for suspicious POST requests targeting the /goform/setcfm endpoint with unusually long funcpara1 parameters (see IOC context in the rule description).
]]>criticaladvisorycve-2026-4904buffer-overflowtendarouterwebserver